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FEDERAL BUREAU OF INVESTIGATION 

Electronic Communication 


Title: (U/71'OUO-h Missing Item - 
302-1A20 


Date: 05/06/2019 


b3 

b7E 


From: WASHINGTON FIELD 
WF-CI13 

Contact 


Approved By: SSA 



Drafted By: [ 


Case ID #: 


(fl) ^//W- MIDYEAR EXAM; 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


J-302-1A20, 


Synopsis: (U//~E* OUO) - To document missing item 

which is described as "FD-597 Receipt for Property" acquired from 
Williams & Connolly LLP 



Reference: 


]— 3 0 2 


Serial 


23 


Details: 


(U//TTOU09 For reference, Washington Field Office (WFO) CI-13 has been 
gathering and copying materials from captioned case in response to a 
Freedom of Information Act (FOIA) tasking from Information Management 
Division (IMD; formerly Records Management Division). 

(U/ /P0U0) On or about February 4, 2019, Special Agents (SAs) | | 

I attempted to locate | ""{ -302-1A20, 

described as described as "FD-597 Receipt for Property" acquired from 
Williams & Connolly LLP (see referenced serial). The SA's looked 


b6 

b7C 


b3 

b7E 


b3 

b7E 


b3 

b6 

b7C 

b7E 


HRC-13978 







SSgRgSV /W CIFORM - 


Title: 
Re: 


(U/ /FOUO) 


KEfcfr-fftnq Item - 


I-302-1A20 


Jgplfi/06/2019 


through all case materials in the CI-13 file and workbox area, 
however, they were not able to locate this item. 

(U/ /F Od ^t~ SA | | inq uired with Supervisory Intelligence Analyst 

(SIA) | I regarding the item, as he was previously the IA 

assigned to the case. He was also not able to locate this item. 

(U/nrO©©! As such, WFO CI-13 considers the item missing and will 
enclose this document into 1A20 as a placeholder until the missing 
item is located. 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-03-2016 BY 376J18T80 NSICG 


FD-302a (Rev. 10-6-95) 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 1/7/2016 


(U/ /FOUO) On January 7, 2016, writer received a 15 page fax froml 


Special 


Agent in Charge at the U.S. Department of State, Office of Inspector General. The faxed documents 
consisted of time and attendance records for Bryan Pagliano. 


(U //FQUO) The faxed documents are enclosed in an attached 1 A. 


Investigation on 1/7/2016 

at 

Washington, DC 

File# 



Date dictated N/A 

Bv FoaI 


] 

1 




This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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b7C DOS 


b3 per 
b7E FBI 


b6 per 
b7C FBI 
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b7E FBI 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 05-06-2019 BY C66W46B11 NSICG 
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-Sae«ET7/N©p©BN- 

FEDERAL BUREAU OF INVESTIGATION 

Evidence Entry 


Official JJecord 

Litis- 


m v 

Event Title: £&) DOS 


Date: 02/01/2016 


Approved By: 


Drafted By: 


b6 per FBI 
b7C per FBI 


Case ID 



£*(//**?■) MIDYEAR EXAM; 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


b3 per FBI 
b7E per FBI 



Full Investigation Initiated: 07/10/2015 


Collected By: Missing on Missing 
Collected From: Department of State 
Receipt Given?: No 
Holding Office: 'WASHINGTON FIELD 


Item Type 

IB Digital 


Description - b6 per D OS, FBI 

(U) 1 CD Marked |_ PST" b7C per DOS, FBI 

Collected On: 01/28 /2016 _ 

Seizing Ind ividual: I | 

Located By: ] 

Location Area: NA 
Specific Location: NA 

Device Type: Compact Disc/Digital Video 
Disc(CDs/DVDs) 

Number of Devices Collected: 1 


TggSRCg /NOFORH 


HRC-859 




flu 


Title: 
Re: 


DOS 


js§c^t7: 


/NCJFUKN" 


02 / 01/2016 


b3 per 
b7E FBI 


♦ ♦ 
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b7E FBI 


HRC-861 





ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 05-06-2013 BY C66W46B11 NSICG 


FD-]087a (Rev. 5-8-10) 
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BUREAU OF INVESTIGATION 

Evidence Entry 





Official Record 


Doom*** r««« eg <a*i 

rmm DMn w»Wd ■ 
cFBI ntamwfcn >y«tsm 


Event Title: (U) EMAILS 


Date: 02/03/2016 


Approved By: 


Drafted By: 


b6 per FBI 
b7C per FBI 


Case ID #: 


(fl) MIDYEAR EXAM; 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


b3 per FBI 
b7E per FBI 



^classify 


Full Investigation Initiated: 07/10/2015 


Collected By: Missing on Missing 


Collected From: 


SPECIAL ASST, DEPT OF STATE 


Receipt Given?: No 


b6 per DOS 
b7C per DOS 


Holding Office: WASHINGTON FIELD 


Item Type 

IB Digital 


Description 

(U) 2 D VDS: OPENNER 
OPENNER 


b6 per DOS, FBI 
b7C per DOS, FBI 


,_|-EMAIL - 2011. PST 

J-EMAIL - 2012. PST 


J 


Collected On: 02/03 /2016 _ 

Seizing Indivi dual: I 
Collected By: | 

Location Area: DEPT. OF STATE 
Specific Location: DEPT. OF STATE 
Device Type: Compact Disc/Digital Video 
Disc(CDs/DVDs) 

Number of Devices Collected: 2 


^gSC^T7' / MOFORH - 


HRC-862 





HRC-863 




VBA 


b3 per 
b7E FBI 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 05-06-2019 BY C66W46B11 NSICG 
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FEDERAL BUREAU OF INVESTIGATION 

Evidence Entry 



Offi cial Rec ord | 

Docwrt p»iKip«.*a Im 
M I'M ty • 

FBI 


Event Title: ]X) DVD provided by DoS 


Date: 02/08/2016 


b6 per 
b7C FBI 


Drafted By: 



Approved By: 


Case ID #: 


(U) MIDYEAR EXAM; 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 



b3 per 
b7E FBI 


Full Investigation Initiated: 07/10/2015 


Collected By: Missing on Missing 


Collected From: |_| 

Department of State 

Receipt Given? : No 

Holding Office: WASHINGTON FIELD 

Item Type Description 

IB Digital (H) DVD provided by Dos containing emails flagged 
during the FOIA process. 

Collected On: 02/05 /2016 _ 

Seizing Indivi dual: I | 

Collected By: | | 

Location Area: NA 
Specific Location: NA 

Device Type: Compact Disc/Digital Video 
Disc(CDs/DVDs) 

Number of Devices Collected: 1 


b6 per 
b7C DOS 


b6 per 
b7C FBI 


-SSgggT TfoTO F ORW ' 


HRC-865 




Title : Tjl (X) 


^senEg^/ woroni t- 


Re: 


DVD prov ided by DoS 
02 / 08/2016 


b3 per 
b7E FBI 


♦ ♦ 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 05-06-2QiS ,frS£ C66W46B11 NSICG 


Offi cial Rec ord 
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FEDERAL BUREAU OF INVESTIGATION 

Evidence Entry 


Event Title: (U) DEPARTMENT OF STATE HQ 


Date: 02/10/2016 


Approved By: 


Drafted By: [ 


Case ID 


#: 


|JJ) MIDYEAR EXAM; 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


b6 per 
b7C FBI 


b3 per 
b7E FBI 



Collected By: Missing on Missing 


Collected From: 


DEPARTMENT OF STATE 


b6 Per 
b7C DOS 


Receipt Given? : No 

Holding Office: WASHINGTON FIELD 


Item Type 

IB Digital 


Description 

(U) ONE (1) DVD LABELED FIELD BM FILES AND MARKED 
SECRET. 

Collected On: 02/1 0/2016 _ 

Seizing Indivi dual: I | 

Collected By: ' 

Location Area: DEPARTMENT OF STATE HQ 
Specific Location: ROOM 6316 
Device Type: Compact Disc/Digital Video 
Disc(CDs/DVDs) 

Number of Devices Collected: 1 


b6 per 
b7C FBI 


_3»©KEX/7NUFURN 





J5»eBgT 7'/ W OFORH 


Titl e: (U) DEPARTME NT OF STATE HQ 

Re: I I 02/10/2016 


b3 per 
b7E FBI 


♦ ♦ 
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BUREAU OF INVESTIGATION 

Evidence Entry 


Event Title: (U) DEPARTMENT OF STATE 


Date: 02/10/2016 


b6 per FBI 
b7C per FBI 

Drafted By: I_I 


Approved By: [ 


Case ID #: | 1 (JJ) fcUHPf- MIDYEAR EXAM; 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


b3 per FBI 
b7E per FBI 



Full Investigation Initiated: 07/10/2015 


Collected By: Missing on Missing 

Collected From: (U) 

Receipt Given?: No 

Holding Office: WASHINGTON FIELD 


b6 per DOS 
b7C per DOS 


Item Type 

IB Digital 


Description 

(U) ONE (1) DVD LABELED I [E-MAIL 2012 

Collected On: 02/10 /2016 
Seizing Indivi dual: | 

Collected By: | 

Location Area: DEPARTMENT OF STATE HQ 
Specific Location: ROOM 6316 
Device Type: Compact Disfj/Digital Video 
Disc(CDs/DVDs) 

Number of Devices Collected: 1 


b6 per DOS, FBI 
b7C per DOS, FBI 
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Title: (U) 

Re: 


DEPARTMENT OF STATE 

02/113/2016 • 


b3 per 
b7E FBI 


♦ ♦ 
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b7E FBI 
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FEDERAL BUREAU OF INVESTIGATION 


Evidence Entry 


Event Title: (U) DEPARTMENT OF STATE 


Date: 02/10/2016 


Approved By: 


b6 per FBI 
b7C per FBI 


Drafted By: 


Case ID #: 


,;gj £s(//Wn- MIDYEAR EXAM; 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

sensitive Investigative matter (sim) 


b3 per FBI 
b7E per FBI 



Collected By: Missing on Missing 


Collected From: 


b6 per DOS 
b7C per DOS 


Receipt Given? : No 

Holding Office: WASHINGTON FIELD 


Item Type 

IB Digital 


Description _ 

<U) ONE (1) DVD LABELED| |e-MAIL 2012 

Collected On: 02/10 /2016 
Seizing Indivi dual: I I 

Collected By: | 

Location Area: DEPARTMENT OF STATE 
Specific Location: ROOM 6316 
Device Type: Compact Disc/Digital Video 
Disc(CDs/DVDs) 

Number of Devices Collected: 1 


b6 per DOS, FBI 
b7C per DOS, FBI 


J5BCegT7 / W O F ORW - 







Titl e: (U) DEPARTME NT OF STATE 

Re: | | 02/10/2016 


b3 per 
b7E FBI 


♦ ♦ 


—ssewsj/VwoFOKif 
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UNCLASSIFIED//~ FOUO - 


ALL FBI IUFORliATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 04-02-2£i£3@r C66W46B11 NS ICG 


21 January 2016 


MEMORANDUM FOR: |_| 

Acting Section Chief 
Counterespionage Section 
Federal Bureau of Investigation 


FROM: |_| 

Associate Deputy Director of Operations 
Central Intelligence Agency, 

Foreign Intelligence and Covert Action 

SUBJECT: (U/7T OUO) - MIDYEAR EXAM: 

Use Request - 5 January 2016 


b6 

b7C 


b3 Per CIA 
b6 Per CIA 
b7C Per CIA 


(U/ / T OUO) By Letterhead Memorandum dated 5 January 2016 
you requested CIA approval to use emails surfaced in the 
referenced case with potential witnesses and their counsel.| 


(U// T 0U04- I am the Associate Deputy Director of Operations 
for CIA, Foreign Intelligence and Covert Action. The content of 
the emails, which was described to me, involve operational 
matters within my' jurisdiction. As such, I have the authority 
to grant approval to use these emails as outlined in the 
referenced use request and release of this memorandum provides 



Attachment: Requested emails 


bl Per CIA 
b3 Per CIA 


liS) 


UNCLASSIFIED//FOyO" 

Y ' 3 © 


HRC-877 


b3 

b7E 




UNCLASSIFIED/ /Few 


ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 HSICG 

U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



Date: 5 January 2016 


To: I. I 

counterespionage Group 
Counterintelligence Center CIA 


From: [ | 

Acting Section Chief _ 

Counterespionage Section 


b3 Per CIA 
b6 Per CIA 
b7C Per CIA 


b6 

b7C 


l ^j ect: -Rgq^ sts authority use classified CIA documents d uring 

interviews ‘ —--—* 


(U/^T0U0f In July 2015, the FBI received a Section 811 referral 
from the Inspector General for the Intelligence Community (ICIG) 
regarding the possible compromise of classified national security 
information. The potential compromise was identified when, as part of 
a Freedom of Informa|«Act (FOIA) request, the U.S. Department of 
State (DoS) and the !M||reviewed electronic mail (email) 
communications from paS-^te email accounts previously used by a 
former Secretary of State during their tenure at DoS. 


(U/mwOI At the request of the FBI, as well DoS and the ICIG, 
the CIA has since conducted classification reviews of emails and 

documents related to this matter that were deemed to contain CIA 
equities. 


(U//rW£) Currently, the FBI plans to interview several 
individuals who originated, transmitted or received classified 

?h^ U FRT tS unclassified ema il system. During these interviews 

the FBI would like to show the interviewee, and if necessary their 

the relevant documents that they were a party to. 
allow the FBI to pursue a logical line of questions 


re, 

sen .?•&?= 


*• — ~ W A. 4UCO LlUIlij 

circumstances in which the classified information was 


UNCLASSIFIED//TTOtfS- 

This document contains neither recommendations nor conclusions of the FBI. it is 
S e be r disSLut P d h o t FBI a and 13 l0aned t0 y ° Ur a9enCy; ifc and its contents'are not 

uo De distributed outside your agency. 




UNCLASSIFIED/^©WCT 


bl Per CIA 
b3 Per CIA 



(U/such, the FBI respectfully requests Central 
Intelligence Agency (CIA) authority to show the above referenced 
emails to those individuals that were originally involved in each 
respective email chain. Given the amount of time that has, elapsed 

UNCLASSIFIED//^e«©- 

This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 



HRC-879 



UNCLASSIFIED//£©W 




-:_f$P ce the eraails were first sent, the FBI believes that it is 
fj^jpessary to show the actual emails to the interviewees in order to 
have a meaningful discussion regarding the context in which the email 
was sent. For each listed email, the FBI will only show the email to 
individuals, and their attorneys, necessary to further the 
investigation. Additionally, standard safeguarding procedures will 
be used to ensure the protection of the content and to prevent any 
unnecessary disclosures. 



Counterespionage Section 


b6 

b7C 


b6 

b7C 


♦ ♦ 



UNCLASSIFIED/,/FOT.*?r 


This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI and is loaned to your agency; it and its contents are-no.t 
to be distributed outside y-our agency. •* 
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UNCLASSIFIED/ / fOUQ — 


ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 04-02-2019 BY C66W46B11 NSICG 


MEMORANDUM FOR: _ 

Acting Section Chief 
Counterespionage Section 
Federal Bureau of Investigation 

FROM: | 1 

Information Review Officer for the Director's Area 

SUBJECT: MIDYEAR EXAM: Use Request-4 January 2016 


FEB 1 0 2016 b6 

b7C 


b3 Per CIA 
b6 Per CIA 
b7C Per CIA 


(U/AOtfOT By Letterhead Memorandum dated 4 January 2016 you requested CIA approval to 
use an email surfaced in the referenced case with two potential witnesses and their counsel- The email 
is unclassified, but for CIA Internal Use Only. 


b3 Per CIA 
b6 Per CIA 


(U//£Oyef I am the Information Review Officer for the Director's Area and have Original 
Classification Authority. As such, I have the authority to grant approval to use this email as outlined in 
the referenced use request and release of t his memorandum provides that approval. b7C Per CIA 


Attachment: Requested email 


UNCLASSIFIED / /-S QU 0- 


" 3°1 
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b7C FBI 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T8G NSICG 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 2/12/2016 


b6 per DOS, 
b7C per DOS 


On February 12, 2016, SA 


__electronically '3&$lhe Department of State (Dos) 

an LHM requesting authority to use DoS emails and documents in future, interviews regarding the 
captioned matter. T h e renuest was . e . ler . trnnira ll v ^ nt to Executive Assistant, Bureau of 

Diplomatic Security] - 


FBI 

FBI 


Copies of the requests are maintained in a 1 A. 


Investigation on 2/12/2016 
File# 


.at_ Washington. DC 


h Vio 


. Date dictated N/A 


MM 


b3 per FBI 
b7E per FBI 


b6 per FBI 
b7C per FBI 


TfeiS document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency it 
and its contents are not to be distributed outside your agency. 1 ’ 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 NSICC 


DAVID E. KENDALL 
(202) 434-5145 
dkendall®wc .com 


LAW OFFICES 

WILLIAMS 8 CONNOLLY LLP 


725 TWELFTH STREET, N.W. 
WASHINGTON, D. C 20005-5901 
(202) 434-5000 
FAX (202) 434-5029 


EDVARD BENNETT WILLIAMS (1930-1088) 
PAUL R CONNOLLY (1932-1978) 


February 22,2016 


BY E-MAIL 


U.S. Department of Justice 
National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 

DeaJ 


1 write to memorialize our responses to two inquiries concerning the Department of 
Justice’s security inquiry. 

You asked that we identify the serial numbers for the Williams & Connolly LLP 
(“W&C”) laptops provided to the Federal Bureau of Investigation on August 6,2015 and 
August 25,2015, and to confirm the positions and number of W&C personnel who had access to 
those laptops during the time period that the laptops contained the .pst file of the e-mails that 
Secretary Clinton produced to the State Department. As listed on the property receipts for those 
laptops, the model and serial numbers are: (1) Lenovo Thinkpad T420, S/N PB-YC912 12/03; 

(2) Lenovo 4236-VQ5 S/N PB-YC910 12/03; and (3) Lenovo 4236-VQ5 S/N R8-NV8XB 11/11. 
Five W&C personnel (three attorneys, one paralegal, and one IT employee) had access to the 
laptops at points during the relevant time period. 

You asked whether Secretary Clinton’s @clintonemail.com e-mails for the time period 
January 21, 2009 through February 1, 2013 were transferred or migrated to the hrcoffice.com 
account. As we indicated, Secretary Clinton did not transfer her @clintonemail.com e-mails for 
the time period January 21,2009 through February 1, 2013 to her @hrcoffice.com account, nor 
did she instruct anyone to do so. 


b6 per 
b7C FBI 


b6 per 
b7C FBI 


Sincerely, 





b3 per 
b7E FBI 


HRC-895 






HRC-896 



DAVID E. KENDALL 
(202) 434-5145 
dkendall@wc.com 
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WASHINGTON, D. C 20005-5901 

(202) 434-5000 
FAX (202) 434-5029 


ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 NSICG 


EDWARD BENNETT WILLIAMS (1D20.IDBS) 
PAUL R. CONNOLLY (I022-J07B> 


February 22, 2016 


BY E-MAIL 


U.S. Department of Justice 
National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 

Dea_ 

I write in response to your February 9, 2016 letter concerning certain equipment and 
devices. Following the inquiries that we have made in response to the requests in your letter, I 
can report the following. 

In relation to your request regarding “Desktop computer in Whitehaven residence: model 
unknown (located at residence as of July 2010),” we have identified an iMac G5, 20” iSight 
computer that is b&feyed to have been housed at the Whitehaven residence during 2010. 

In relation to your request regarding an iPad “Generation 1 (Model A1337): Serial 
unknown (first use: June 2010),” we note that the iPad that we have previously identified to you, 
and which will be voluntarily produced pursuant to a consent letter is a Model A1337. 

We have not located any equipment or devices matching the descriptions of the 
remaining items in your letter. 


b6 per 
b7C FBI 


b6 per 
b7C FBI 



HRC-897 


b3 per 
b7E FBI 


■X 


-V 


A 


b6 per 
b7C FBI 


HRC-898 



ALL FBI INFORMATION CONTAINED 

BERZIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 NSICG 



DAVID E KENDALL 
(202) 434-5145 
dkendall@wc.com 


LAW OFFICES , i 

WILLIAMS 8 CONNOLLY LLP 1 

725 TWELFTH STREET, N.W. j 

WASFUNGTON, D. C 20005-5901 imamj mnnett williams <ieao-ioes> 

PAUL R. CONWOILY (1022-1970) t 

(202) 434-5000 f 

FAX (202) 434-5029 l 


February 23, 2016 


BY E-MA IL 


U.S. Department of Justice 
National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 

Dearl 


This letter provides consent, m dcmcection with the Department of Justice’s security 
inquiry and subject to the provisions set forthherein, (1) to search the iPad, Model A1337 
(hereinafter “the device”) provided to the Federal Bureau of Investigation (FBI) for Secretary 
Clinton’s e-mails and files dated January 21,2009 to February 1,2013; and (2) to conduct a 
forensic analysis of the device for the purpose of identifying information relevant to the 
Department of Justice’s security inquiry. This consent applies solely to the above-described e- 
mails and files of Secretary Clinton, and not to any of her e-mails and files outside of the date 
range or to the e-mails or files of any other individuals that reside on the device. 


b6 per 
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You have confirmed that any searches of the device will be undertaken initially by a filter 
team, who will hold back from the investigative team any e-mails or files that may contain 
privileged information. You have further confirmed that the filter team will set aside any e-mails 
or files (including Contacts) that are associated with the @ hrcoffice.com domain account or 
created after February 1 ,"2013; and that any e-mails or files associated with that domain account 
or created after February. 1, 2013 will not be searched or reviewed by anyone, even by the filter 
team, or otherwise be usedia connection with your security inquiry or for any other purpose, as 
those e-mails and files wer© not in existence during the relevant time period. In order to preserve 
the data on the device, we agreed, as of December 23, 2015, not to turn on the device or to 
otherwise modify the device prior io its production to the FBI. 

In connection, with the filter team’s efforts to segregate from the investigative team any e 
mails or files that may contain privileged information, I incorporate by reference my October 1, 
2015 letter, which provides a list of individuals and entities with whom Secretary Clinton may 
have communicated in a privileged context, and my October 16, 2015 e-mail, which 
supplemented that list. 





WILLIAMS 8 CONNOLLY LLP 
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February 23, 2016 
Page 2 


Ipgisj 

We request and antic^^^iat the device, as well as any of Secretary Clinton’s non- 
federal record e-mails or files oh fee device, will be returned to us at the conclusion of your 
inquiry. 



HRC-900 





HRC-901 


FD-302a (Rev. 10-6-95) 


ALL FEI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 NSICG 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


b3 Per CIA 
b6 Per FBI, CIA 
b7C Per FBI 


On February 24, at apt 


Jr -,-v 


Date of transcription 2/24/2016 


3:50 PM, Special Agent|_ 


Jprovide<£ 


FBI liaison to the p^tirifcrsspionage Group Counterintelligence Center, Central Intelligence 
Agency (CIA), with an LHM requesting assistance in contactin g former CIA Deputy Director Michael 
Morell for an interview. The LHM was provided to | I via the FBI Microsoft Lync system. 


A copy of the LHM is enclosed in an accompanying 1A. 


b3 per FBI 

Investigation on 2/24/2016 _at Washington. DC __ b7E per FBI 

File # J l~~ \ _Date dictated N/A _ 



b6 per FBI 
,b7C per FBI 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 2/24/2016 


On February 24, 2016, SA[ 


b3 per CIA 
b6 per FBI, CIA 
b7C per FBI 

provided the Central Intelligence Agency (CIA) 


with an LHM to give notice that the FBI planned to use documents possibl y mntainino classify CIA 
equities during future interviews. The LHM was provided to CIA detaillee 


A copy of the LHM is enclosed in an attached 1 A. 


Investigation on 2/24/2016 _at 


File# 



BvSA 


Washington. DC _ 

_ Date dictated N/A 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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United States Department of State 

Assistant Secretary of State 
for Diplomatic Security 

Washington, D.C. 20520 


UNCLASSIFIED 


February 26, 2016 


TO: 

FROM: 


FBI - Peter Strzok 
DS - Gregory B. Starve 






SUBJECT: Request for Authority to use Classified Department of State 
Documents During Interviews 


Thank you for your letter of February 12, 2016 regarding the FBI’s request 
for authority to show classified Department of State e-mails and documents during 
interviews. We have received by e-mail a list of 74 individuals whom the FBI may 
want to interview regarding these documents. 

1"he Department of Stale understands the FBI’s desire to use these 
documents in interviews to pursue logical lines of questioning pursuant to your 
investigation, and similarly understands the desire to share these documents with 
both interviewees and their legal counsel if necessary. However, we are 
particularly concerned about sharing the 22 e-mails determined by the Intelligence 
Community (IC) to contain Top Secret (TS) information. The Department poses 
no objection to the FBI’s plan to use the documents during interviews, but the 
Department believes that any individual, to include legal counsel, with whom these 
e-mails will be shared must have appropriate security clearances and must be read 
in to any special access program discussed in the relevant e-mail by the 
Department of State’s Bureau of Intelligence and Research or by the appropriate 
1C element. 


The Department has independently identified the recipients of the 22 TS e- 
mails for the purposes of placing the documents under proper controls and 
performing any necessary inadvertent disclosure procedures (the number of 
contemporaneous recipients is a small fraction of the list provided to the 
Department by the FBI). We have also compiled and can provide information on 
which recipients were cleared for access to the information at the time the e-mails 
were sent and which recipients are cleared for such access now. In addition, we 
can provide their current employment status and the status of their security 
clearance. We can provide the same information for those individuals on the FBI’s 
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list who did not have access to the e-mails determined by the IC to contain TS 
information. With respect to individuals not currently employed by the 
Department of State, the Department defers to the FBI to determine whether they 
may be granted a TS security clearance and have the necessary need to know for 
purposes of granting access to the information contained within the e-mails. If the 
FBI makes an affirmative determination, the Department has no objection to the e- 
mails being shown to the interviewees and their legal counsel. 

Should you wish the Department of State to provide the information above, I 
request the FBI inform the Department of State in writing. We will then provide 
the requested information through our previously established channels. 


Attachment : 

Tab - FBI Letter dated February 12, 2016 


UNCLASSIFIED 
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Approved: DS - Gregory B. Stan- 


Drafted: DS A 


Cleared: M - PKennedy (ok) 

L- 
INR - 
INR - 


(ok) 

(ok) 

(ok) 
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United States Department of State 

Assistant Secretary of State 
for Diplomatic Security 

Washington, D.C. 20520 


SENSITIVE - BUT UNCLASSIFIED March 1,2016 


MEMORANDUM FOR RECORD TO THE FEDERAL BUREAU OF 
INVESTIGATION 


FROM: DS -Gregory B. Starr 




SUBJECT: State’s Compliance Regarding FBI Requests 

(U) I am writing to follow up on our January 29 ,h video teleconference and 
our February I s * meeting regarding the Department of State’s response to the FBI 
investigation of Secretary of State Hillary R. Clinton’s emails. 


(S DU) In our discussions on the production of records, the Department of 
State previously outlined current IT data management. As we have said, technical 
limitations affect our ability to achieve full compliance with the Bureau’s request. 
We remain committed to working with the FBI investigative team to refine the 
request to ensure the most compliant response possible. 


(U) My staff, with principal point of contactj 


can work with 


FBI personnel and offices from State to determine how or if we can be best 
responsive. 


b6 per 
b7C DOS 


/ 

Kr 

Attachment : 

Tab - DOS IT Technical Limitations 
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Approved: S/ES - foe Macmanus (OK) 
Drafted: DS -j_ 


Cleared: 


IRM-J 

INR-f 


JLQK) 
(OK) 


A/GIS - Peggy Grafeld (OK ) 
S/ES - IRM \ | (OK) 
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Department of State IT Technical Limitations 


This paper outlines technical limitations of the Department of State’s IT 
infrastructure as related to the FBI investigation into Secretary of State Hillary R. 
Clinton’s emails. 

Limitations Due to Organization and Infrastructure 

(U) The Department of State (DOS) is committed to a thorough and timely 
response to the multiple data production requests from the Federal Bureau of 
Investigation (FBI). However, as previously noted, technical limitations affect this 
outcome. The Department’s use of multiple networks, multiple administrative 
entities, and multiple policies governing the storage, retention, and disposition of 
documents and e-mails created over the time period outlined in the FBI’s requests 
are the chief obstacle in our efforts to comply. In addition, until 2009 the 
Department’s email retention policy relied or. individual employees to print and 
file the emails the individual employee judged to be a record. Beginning in 2009, 
while “print and file” remained the official general guidance of the Department, the 
Department nevertheless captured the inboxes of certain senior officials on their 
departure. Again, as previously described, this capture would include all emails 
still residing in their email inbox but would not include any emails they had 
previously deleted. 

The Disparate Nature of Networks Create Challenges 

■ (SB U) Data requested by the FBI potentially resides on four different 
physical networks: OpenNet (unclassified up to SBU), PACE (unclassified for 
Public Affairs), ClassNet (up to Secret), and a TS/SCI information system operated 
by the Bureau of Intelligence and Research (INR). The Department does not 
maintain a single data owner or custodian for the OpenNet and ClassNet systems. 
Rather the data custodians, data owners, and official archivists vary according to 
which information resource management office supports the employee’s bureau. 
Consequently, multiple offices may need to take action in response to the data 
production requests, depending on the assignment history of the employee in 
question. On these two networks, the IRM Bureau is the largest data custodian, 
managing approximately 25% of mailboxes, primarily for users located in the 
Washington DC region. Mailboxes for these users are limited to 5GB and users 
routinely use Personal Archives (.pst files) to store older e-mail that exceeds this 
storage location. These .pst files are stored in multiple locations by users, including 
home directories, other network shares, local workstations, and sometimes on 
removable media. As a result, IRM can only fully verify content of “active” 
mailboxes - anything archived in a .pst file may or may not be discovered. The 
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data owner of these IRM-managed mailboxes is the bureau to which the employee 
is assigned. When the employee departs the Department, the data owner is 
responsible to determine the disposition of the mailbox and other user-created files. 
The data owner has the ability to retain the files within the bureau or transfer them 
to the A Bureau for official archiving. Regardless of the decision, the e-mail and 
files are removed from the on-line system six months after the employee leaves the 
Department. After this time, IRM can no longer access and provide the data. 


(SBU) The Secretary, other Department Principals, certain Special Envoys, 
their staffs, and the Executive Secretariat (S/ES) use OpenNet and ClassNet 
accounts m a system called the Principal Officers’ Executive Management 
Support, ot POSJMS. The Executive Secretariat manages POEMS through its IT 
office, S/ES-IRM. When an official leaves the Department, S/ES-IRM, in 
coordination with record-keeping officials in S/ES and staff from the official’s 
office, creates one or more .pst files containing the departing official’s email, and 
saves all material stored on the official’s personal drive, or P drive, to the same 
.pst. That data is backed up and kept indefinitely. S/ES-IRM performed this 
procedure for several prior administrations. While comprehensive in capturing all 
extant emails, this process did not, however, preserve emails..psvjot^ly deleted by 
the official. 



(U) For overseas users and for domestic locations U.S. Mission 

to the UN, the Department’s administrative center in Charleston, Sfc, the offices of 
the Inspector General, and U.S. passport offices, the data custodian and owner are 
the U.S. embassy or consulate where the employee works, or domestic office itself. 


(U) Many Department employees including Foreign Service regularly rotate 
assignments from domestic to foreign assignments and between different locations 
in the Department. Department administrative restrictions place limits on the total 
bandwidth available for the storage of an individual employee’s email and other 
data. Employees must therefore reduce their total on-line data storage prior to 
departure. In this way, they may enable the transfer of their data over the OpenNet 
and ClassNet networks from the office they are departing and to the office or 
mission abroad where they will arrive. 

(U) Furthermore data transfer is also liim^i by policy. The Foreign Affairs 
Manual states, “Department workforce membsk Must not take official files with 
them when they are reassigned to the field from the Department, to the Department 
from the field, or between posts unless the records transfer has been approved by 
A/GIS/IPS/RA.” (5 FAM 432.4) As a result, finding specifically requested 
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for individuals who have rotated assignments since the date the item was created is 
especially difficult. 

INR Network 

(SBtf) The Department’s TS/SCI netw^jjgj^the most straightforward, 
particularly with respect to email, because the J1| only one data custodian (INR) 
for email sent on that network (sometimes referred to as “ice-mail” because it 
resolves to @state.ic.gov email addresses). Pursuant to Intelligence Community 
(IC) guidance, INR saves electronic records for 25 years. Since early 2014 it has 
backed records up to disk in addition to less reliable tapes, which previously were 
used exclusively. Also, in November 2014 INR installed Comm Vault Indexer. 
INR is now able to search electronic records, including ICEmail, relatively easily. 
For periods predating early 2014, however, restoration of email accounts may be 
difficult or, in the case of certain older accounts, impracticable if not impossible. 

(SBST) Department users' with ice-mail accounts fall into two categories: 
those who have Information Support System) accounts and those 

with “elntel” accounts, i^sirv/ere first introduced to the Department by INR in 
2008. During 2O09-&13, INR inaintained two mail servers, one for INRISS 
account holders and another for elntel account holders. In early 2014 INR began 
transitioning elntel users to the INRISS mail server. In the process of migration, 
only active accounts were migrated. If at the time it was reached in the migration 
process an account had not been logged into within the prior 365 days it was 
deemed inactive and retired; its mailbox contents were saved into a PST file and 
stored on a file server that was decommissioned in late 2014. That server is still 
available, and the PST files on this server can be accessed, but the PST files 
represent the user’s mailbox as it existed the day the account was retired. To 
determine what the account looked like prior to its retirement INR must turn to the 
former elntel mail server’s tape backups, which are old and rely on infrastructure 
that is no longer in operation. 

(SBU ) With respect to the ICEmail accounts requested by the FBI, all were 
elntel accounts and were inactive at the time of the 2014 migration mentioned 
above. With one exception, the associated PST files that were saved and stored 
contained no data, indicating a mailbox that was empty at the time of the 
migration. The one PST file that was not empty was copied and provided to the 
FBI. 
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Detail Specific Search Requests Yield Better Results 
(U) The Department of State’s current search technology does not allow cross¬ 
enclave searches, Most Department email data searches are done using relatively 
simple Outlook search tools, i.e. keyword searches of specific .psts or email boxes. 
Such searches are based within specific selected employees’ records. It is 
therefore not possible to conduct a search in response to vague or general requests 
that specify “si! e-mail to or from” or “all e-mail related to” a particular topic. 

Even within one of the above systems, there is no comprehensive search method 
that can eve& attempt such a search, much less provide accurate results. Instead 
requests should specify the empkyees’ electronic records to be searched, 
timeframes, and relevant keywords. For example, “all e-mail between users x and 
y regarding (topic keywords)" or “all e-mail related to w either sent or received by 
users x,y, and z between xxx date and yyy date” will have a much greater chance of 
yielding responsive records, assuming those employees’ records are available. 
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U.S. Department of Justice 
Federal Bureau of Investigation 

In Reply, Please Refer to 
File No. 



March 8,2016 


Gregory B. Starr 

Assistant Secretary of State for Diplomatic Security 
U.S. Department of State 
2201 C Street, NW 
Washington, DC 20520 

Dear Mr. Starr: 

I am writing in response to your letter dated February 8, 2016 regarding the Department 
of State’s Freedom of Information Act (FOI A) review of former Secretary of State Hillary 
Clinton’s emails. We appreciate your concerns about the impact that the Department of Slate 
(DOS) actions may have on our ongoing investigation. Consistent with DOS’s normal practice, 
as described in your letter, DOS should hold in abeyance any administrative action related to the 
mishandling of classified information for a limited and reasonable amount of time until the FBI 
can determine what, if any, impact such action might have on our investigation. 

As for the emails that have been classified by the US Intelligence Community or DOS, 
the FBI recommends that you follow the standard security procedures established by DOS to 
remove potentially classified materials from any unclassified network. 

Finally, with regard to Congressional requests for copies of the former Secretary’s 
classified emails, the FBI defers to DOS to respond consistent with its normal practices.. 

Sincerely, 

£. tJ. T 

E.W. Pricstap 
Assistant Director 
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Central Intelligence Agency 



Washington, D.C. 20505 


MAR 0 12016 
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MEMORANDUM FOR: 

ATTENTION: 


SUBJECT: 
REFERENCE: 


Director 

Federal Bureau of Investigation 

Peter P. Strzok 
Section Chief, CD-4 
Counterintelligence Division 



(U//J©W) MIDYEAR EXAM - Response to LHM 
(U//JOUOT FBI LHM, dtd 24 Feb 2016 



1. (U//.FOW7 Action Requested : For your informat ion and 

■acJ-J-Qp aa_aimrnpr i at. p. _ Please forward to Special Agent 


2. (U//JXJUOT" The following information is provided for 
the exclusive use of your organization for background, 
investigative, or lead purposes, as appropriate. It may not be 
used in any legal proceeding without prior coordination. While 
the information may be shared with necessary investigative 
components of your organization, it should not be released in 
any form to other components within the CIA or any other 
agencies without prior approval of the Chief 
Counterintelligence Mission Ce nter , [ 


b6 per FBI 
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Counterespionage Group (C/CIMC/ I l /CEG) . Details contained in 
this CIOL may not be uploaded into any SIPRNET-based computer 
system. 
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SUBJECT: (U//-F©U07 MIDYEAR EXAM - Response to LHM 


— — - 


3. (U/^FGW) This CIOL responds to your 
24 February 2016 in which you asked for CIA assisc^^^^^ 
arranging an FBI interview of former DDCIA Michae|f^^^^.on a 
voluntary basis. FBI detailee to CIMC/CEG further ''expiaiiled 
that FBI is seeking this interview because of Mr. Morell's 
subject matter expertise; he is not Uig^fcarget or subject of the 
underlying sensitive matter. Mr. Morrequests that his 
attorney, Ken Wainstein, be present iu.ie interview; 

Mr. Wainstein is unable to meet on 4 March 2016. Mr. Morell 
indicated that Mr. Wainstein can be reached at (202) 862-2474 to 
schedule a meeting. 


4. (U//F©tTC7 Please address all correspondence concernin g 
this matter to the Counterintelligence Mission Center^I I b3 Per CIA 

I Counterespio nage Group, Attention: 

commercial line 1 
given below. 


J referencing the CIOL number 
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FOR THE ASSISTANT DIRECTO R/CIA FOR : 
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March 21,2016 


TO: 


FBI-E.W. Priestap 


FROM: DS - Gregory B. S 


SUBJECT; 



’iitftaEummqatfJtamew ofHillary Clinton E-mails Classified Secret or 

!./ March 8,2016 (Tab 1), which contained helpful 
"Writing to inform you that the Department of State 
limited redactions, versions of the Hillary Clinton 
^lfidential during the Freedom of Information Act 
Reared members and staff of the Senate Foreign 
is'sibly starting as early as this week. The e-mails 
may be shared with additional committees in the future. The e-mails will be 
available for review, either in-camera or at the State Department, but will not be 
retained by the reviewers. In addition, reviewers will not be permitted to make 
copies or otherwise reproduce the contents of the e-mails during their scheduled 
review. 


ThairaK 

guidance. \ M) 
intends to mr' 
e-mails clAf 
review pro*: 
Relations Co 



The 22 e-mails determined by the IC to contain Top Secret information will 
not be made available to the SFRC. 


Attachments : 

Tab 1 - FBI letter dated March 8, 2016 

Tab 2 - Department of State letter dated February 8, 2016 
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U.S. Department of Justice 
Federal Bureauof Investigation 

In Reply, Please Refer lo 
File No. 



March 8,2016 

Gregory B. Starr 

Assistant Secretary of State for Diplomatic Security 
U.S. Department of State 
2201 C Street, NW 
Washington, DC 20520 

Dear Mr. Starr: 

I am writing in response to your letter dated February 8, 2016 regarding the Department 
of State’s Freedom of Information Act (FOIA) review of former Secretary of State Hillary 
Clinton’s emails. We appreciate your concerns about the impact that the Department of Slate 
(DOS) actions may have on our ongoing investigation. Consistent with DOS’s normal practice, 
as described in your letter, DOS should hold in abeyance any administrative action related to the 
mishandling of classified information for a limited and reasonable amount of time until the FBI 
can determine what, if any, impact such action might have on our investigation. 

As for the emails that have been classified by the US Intelligence Community or DOS, 
the FBI recommends that you follow the standard security procedures established by DOS to 
remove potentially classified materials from any unclassified network. 

Finally, with regard to Congressional requests for copies of the former Secretary’s 
classified emails, the FBI defers to DOS to respond consistent with its normal practices, 

Sincerely, 

£. cj. T 

E.W. Pricstap 
Assistant Director 
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United States Department of State 

Assistant Secretary of Stale 
for Diplomatic Security 

Washington, D.C. 20520 



I am writing to follow up on our January 29,2016 video teleconference 
regarding the current status of the Department of State’s Freedom of Information 
Act (FOIA) reviews of former Secretary of State Hillary R. Clinton’s e-mails. 


Late last week the Department reported that 22 Clks?ed,f;-mails would not be 
publically released due to their Top Secret (TS) classification at the request of the 
Intelligence Community (IC). That is, under FOIA, these e-mails were denied in 
full, but they are being accounted for in the Clinton e-mail collection. In addition 
to these 22 TS e-mails, portions of 22 other e-mails have been classified Secret by 
the State Department or the 1C to date. Finally, approximately 1300 e-mails 
contain sensitive information that was previously redacted and classified as 
Confidential prior to the e-mails’ release under our FOIA process. 


The Department of State is prepared to take appropriate administrative 
action for any instances of mishandling of classified information in accordance 
with our own internal processes (see Attachment). However, we appreciate the 
sensitivity of ongoing criminal investigations generally and do not want to 
compromise or hinder the FBI’s current investigation in any way. It has been the 
normal practice of the Department and the Bureau of Diplomatic Security to delay 
taking administrative action against current State employees when active criminal 
investigations of a parallel nature are underway. I request the Department of 
Justice (DOJ) and FBI inform the Department of .State in writing as soon as 
possible if the Department of State can under^fe administrative investigations or 
inquiries into possible security violations, or BNS&# Department of State should 
delay due to the current criminal investigation until notification to proceed is 
received from the DOJ and FBI. 


HRC-928 




In addition, following up on my letter of September 15, 2015, please be 
advised feat pending further guidance from the FBI we are still - as a general rule 
- not removing any emails that have since been classified from any unclassified 
systems or providing instruction to individuals that may have upgraded classified 
emails on non-official email accounts to take steps to protect this information. 

Finally, Congressional Committees have requested unredacted copies of 
former Secretary Clinton’s classified e-mails. I request DOJ and FBI inform the 
Department of State in writing as soon as possible as to whether they have any 
concerns regarding such a possible production of these e-mails in unredacted form 
at this juncture. I note that we are not considering turning over to any Committee 
documents fee members/staff are not cleared to receive because of their 
classification level. 


Attachment : 

Tab - 12 FAM 550 Security Incident Program 


HRC-929 



Approved: DS - Gregory B. Stan- 


Drafted: 
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Collected Item Log 


(U) 

Event Title: 


^8^ Collect from DoS under 
banner/FOIA authority 


Date: 04/06/2016 


Approved By: 


Drafted By: 
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Case ID #: 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


1 (U) jtS^/TW- MIDYEAR EXAM; 


b3 per FBI 
K7TP. nor PRT 



jsify 


Full Investigation Initiated: 07/10/2015 
Collected From: 

Department of State 

Receipt Given? : No 


Holding Office: WASHINGTON FIELD 


b6 per DOS 
b7C per DOS 


Details: No Details Provided 


Item Type 

IB Digital 


Description 

(U) DVD containing PST for 
Collected On: 04/06 /2016 
Seizing Individual: 
Collected By: [" 


Location Area: N/A 


Specific Location: N/A 

Device Type: Compact Disc/Digital Video 
Disc(CDs/DVDs) 

Number of Devices Collected: 1 


b6 per DOS, FBI 
b7C per DOS, FBI 


SSeesSz/ / m ofoiw 

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency, it and its 
contents are not to be distributed outside your agency 


HRC-932 








jj — 

Tit le: Collect from DoS under banner/FOIA authority 

Re: | I 04/06/2016 


b3 per 
b7E FBI 


♦ ♦ 


ISeewag ^we re RW 
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JSEG8SXT 



b3 

b6 

b7C per 
b7E FBI 


HRC-936 





:3SCSgT7 7KOFOKM 


ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATS 11-10-2016 BY J76D18T80 NSICG 



U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



Date: March 18, 3GIG 


b3 Per CIA 

_b6 Per CIA 

Counterespionage Group b7c Per cia 

Counterintelidgence Center CIA 


From: Peter P. Strzok 

Section Chief 
Counterespionage Section 


Subject: Request for identification 


]£/ /4*fT The FBI Washington Field Office (WFO) respectfully 
requests the CIA's assistance in identifying the names and current 
location of the individuals who occupied the positions listed below 
during the date ranges provided. This assistance is in regards to 
requests for FBI interviews. These interviews are voluntary and 
pertain to a sensitive matter in which the FBI believes the 
individuals may be of assistance. M Per cia 


fe.3 Per CIA 

May 2011 - S eptember 2012 


September 2Ul2~ 


May 2011 - 


(S) 


TUT T 


~1 May 2011 - September 2012 

May 2011 - September 


Director. Counterterrorism O.nr.p.r. 


2010 r 2012 

2010 - 2012 


(S) 


This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 


i 
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>*U4^W / UiUI 


(U//FOUO) If you have any questions 

please direct all inquiries to Special Agent 



regarding this reque st, 

at 

b6 per 
b7C FBI 


Peter P. Strzok 
Section Chief 
Counterespionage Section 


♦ ♦ 


•^BSftgg/ MOFOIW 

This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 


HRC-938 



b7C per 
b7E FBI 





HRC-939 


jsaggT7 |~ \ 


NOFORN 


ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 04-02-2019 BY C66W46B11 HSICC 

b3 Per CIA 


Central Intelligence Agency 



Washington, D.C 20505 


APR 0 7 Z 016 


MEMORANDUM FOR: 

ATTENTION: 

SUBJECT: 

REFERENCE: 


Director 

Federal Bureau of Investigation 

Peter P„ Strzok, II 
Section Chief, CD-4 
Counterintelligence Division 

i ' > 

(U) MIDYEAR EXAM - (R«)sjoonae LHM 

(U// FOUO) FBI LHM, dhd 16 S&*cH. 2016 

: . ,;}; jHlJ.'j Wlfl 


• ■ > « t , 

1. (U/ / - F0UQ) Action Requested : For ycrt-vr inEqriaaf ion and 


action, as appropriate. Please forward to “Special '/igent^ 


] 


b6 per 
b7C FBI 


2. (U/ / -F OU0 4- The following information is provided for 

the exclusive use of your organization for background, 
investigative, or lead purposes, as appropriate. It may not be 
used in any legal proceeding without prior coordination. While 
the information may be shared with necessary investigative 


CIOL-0254-16 


b3 Per CIA 


fo OFORN 


HRC-940 




(U) SUBJECT: 


MIDYEAR EXAM - Response to LHM 


components of your organization, it should not be -nvased in 
any form to other components within the CIA or an> er 

agencies without prior approval of the Chief, _ 

Counterintelligence Mission Ce nter. | 

Counterespionage Group (C/CIMC/ I [ CEG) . Details contained in 
this CIOL may not be uploaded into any SIPRNET-based computer 
system. 

3. \ Per the referenced FBI Letterhead 

_ /TTm\ J _ 4- ^ J -y n C\ "1 r vN-v-«Tfl Arm 4- -» 4- 4 


b3 Per CIA 


bl Per CIA 
b3 Per CIA 
b6 Per CIA 

























_- It-2. 


b3 

b6 

b7C per 
b7E FBI 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76018T80 NSICG 



DAVID E KENDALL 
(202) 434-5145 
dkendall@wc.com 


LAW OFFICES 

WILLIAMS & CONNOLLY LLP 

725 TWELFTH STREET, N.W. 

WASHINGTON, D. C 20005-5901 EEW7ARD BENNETT WD.UA-.iL- 'r420-l9BS> 

PAUL R CONNOLLY UeSS~iS>78> 

(202) 434-5000 
FAX (202) 434-5029 


April 15,2016 

BY E-MAUL V 


U.S. Department of Justice 
National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 


Dea£ 


This lefts* provides consent, in connection with the De 
inquiry and subject to ^ ^visions set forth herein, to condupJiff.t^IimjWily^at^'aa^n of the 
iPad mini, Model A1432 hereinafter “the device”) provided to the of /, 

Investigation (FBI), for the limited purposes of (I) determining leather 
Clinton’s e-mails and files dated January 21, 2009 to February 'Ptt;th^dbY{ee; and 

(2) conducting an analysis of the device to determine whether Mf occurred You have 

represented to us that the intrusion analysis will not involve semh pf ^fy e-ESails or 

files that reside on the device. Furthermore, to the extent the FBI determines in that preliminary 
examination that no e-mails or files of Secretary Clinton dated January 21, 2009 to February 1, 
2013 reside on the device, you have agreed to return the device to us promptly without 
conducting any further examination of the device other than the intrusion analysis. 

To the extent the FBI determines in its preliminary examination that e-mails or files 
Secretary Clinton dated January 21,2009 to February 1, 2013 do reside on the device, this 1 
provides consent, in connection with the Department of Justice’s security inquiry and su 
the provisions set forth herein, to search such e-mails and files of Secretary Clinton dated 
January 21,2009 to February 1, 2013 (in accordance with the procedures outlisscdLhdbss*) to: 


purpose of identifying information relevant to the Department of Justice’s 
consent applies solely to the above-described e-mails and 
any such files exist on the device), and not to any of her e-mails and files oi 
range or to the e-mails or files of any other individuals that may reside on 




This 
ie extent 


b6 per 
b7C FBI 


b6 per 
b7C FBI 

* 

l 

\ 
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WILLIAMS 8 CONNOLLY LLP 


April 15, 2016 
Page 2 

-' ' Yon feavr confirmed that the searches consented to above will be undertaken first by a 
hold back from the investigative team any e-mails or files that may contain 
privileged irifokhatioa, as well as all e-mails and files outside of the scope of the searches 
consented to above. You have further confirmed that the filter team will set aside any e-mails or 
files (including Contacts) that are associated with the @hrcoffice.com domain account or were 
created after February 1, 2013; and that any e-mails or files associated with that domain account 
or created after February 1,2013 will not be searched or reviewed by anyone, even by the filter 
team, or otherwise be used in connection with your security inquiry or for any other purpose, as 
those e-mails and files were not in existence during the relevant time period. 

In connection with the filter team’s efforts to segregate from tbs investigative team any e- 
mails or files that may contain privileged information, I incorporate fcyfsfbrence my October 1, 
2015 letter, which provides a list of individuals and entities with whom Secretary Clinton may 
have communicated in a privileged context, and my October 16,2015 e-mail, which 
supplemented that list. ' Ippp 

In the event that the device is determined in the FBI’s preliminary examination to ecMain 
e-mails or files of Secretary Clinton dated January 21, 2009 to February 1, 2013, we request and 
anticipate that the device, as well as any of Secretary Clinton’s non-federal record e-mails or 
files on the device, will be returned to us at the conclusion of your inquiry. 


b6 per 
b7C FBI 



HRC-961 





b3 

b6 

b7C per 
b7E FBI 


i 
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■ALU FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 NSICC 


DAVID E. KENDALL 
(202) 434-5145 
dkendall9wc.com 


LAW OFFICES 

WILLIAMS 8 CONNOLLY LLP 

725 TWELFTH STREET, N.W. 

' WASHINGTON, D. C 20005-5901 tw*M> hnneti wiujamsuom.iomi 

,J PAUL R. CONNOLLY 0822-1970) 

(202) 434-5000 
FAX (202) 434-5029 


BY E-MAIL 


April 22,2016 


U.S, department ot Justice 
National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 



This letter confirms that, pursuant to our discussions, Williams & Connolly LLP 
(“W&C”) has provided to the Department of Justice two W&C hard drives (a Samsung Lenovo 
256 GB hard drive and a Samsung Lenovo 128 GB hard drive) (the “drives”) for the sole 
purpose of destruction. The drives each contained a copy of data that W&C had previously 
provided to the Department of Justice, as well as other W&C attorney-client privileged and 
attorney work product materials. Pursuant to our agreement, W&C has deleted all data from the 
drives prior to providing them to the Department. We understand that once the drives have been 
destroyed, you will provide us confirmation of that fact. For avoidance of/loubt, this letter does 
not provide any consent to search the drives prior to their destruction./ r 


Sincerely, 



b6 per 
b7C FBI 


b6 per 
b7C FBI 
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b6 per 
b7C FBI 


HRC-975 



ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 11-10-2016 BY J76J18T80 NSICG 




U.S. Department of Justice 
National Security Division 


Washington. D.C. 30530 


David E. Kendall, Esq. 
Katherine M. Turner, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


February 9,2016 


Dear Mr. Kendall and Ms. Turner, 

I b5 per NSD 


1. Laptop Computer 

• MacBook Air: Serial unknown (purchased November 2008) 


2. Desktop Computer 

• Desktop computer in Whitehaven residence: model unknown (located at residence as of July 

2010) 


3. iPads 

• Generation 1 (Model A1337): Serial unknown (first use: June 2010) 

• Generation 3: Serial DLXHFT7VDVGJ (first use: May 2012) 

• Mini: Serial unknown 

4. Phones Associated with (212) 920-6329 

• BlackBerry Curve 8310: IME1 359315014408230 (January 2009 - May 2009) 

• BlackBerry Curve 8900: 1MEI 359485022135651 (June 2009 - September 2009) 

• BlackBerry Curve 8900: 1MEI 358453025219261 (September 2009 - August 2011) 

• BlackBerry Curve 8900: IME1 358453029684668 (August 2011 - February 2012) 

• BlackBerry Curve 8900: IMEI 355383038220886 (February 2012) 

• BlackBerry Bold 9900. IMEI 357966040796790 (February 2012) 

• BlackBerry Curve 8900: IMEI 355383039952164 (February 2012 - March 2012) 

• BlackBerry Curve 9360: IMEI 357965040112701 (February 2012 - March 2013) 

• BlackBerry Curve 9360: IMEI 357965043386724(MarcWIJ - October 2013) 


- \(ab 


b3 per 
b7E FBI 


HRC-976 








• BlackBerry Bold 9900:1MEI357966044557578 (October 2013 -November 2015) 

• BlackBerry Bold 9900: IMEI3 5 7966044869312 (December 2014) 

5. Phones Associated with (212) 920-7127 

• Sony Xperia Z C6603: IMEI 3557620541 'Si % f April 2013) 

• Motorola EX431G: IMEI 3 5 9486042036& '(September 2013 - February 2014) 


6. SIM Cards with One of the Following Identifiers 

IMSI (stored digitally on the SIM card): 

• 310410088779408 

• 310410248923744 

• 3i0410492968953 

• 310410758808198 * 

• 310410774223342 

• 310410785717450 

• 310410178586207 

• 310410208687757 

• 310410248923744 

• 310410283447343 

• 310410331125794 

• 310410408399442 

• 310410676110393 

• 310410785725002 

• 310410614126238 


ICCID (may be written on outside of SIM card): 


89014104200887794085 

89014102232489237447 

89014104254929689530 

89014103277588081989 

89014103277857174507 


b5 per NSD 


Sincerely. 


b6 per 
b7C FBI 


2 
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b6 per 
blC FBI 


ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 HSICG 


RO) (FBI) 


iPad Minis 


J(NSD]J 

Li, 201o SAl HIV 
_L (RO) (FBI) 

_KNSD) (JMD) 


b6 per FBI 
"b7C per FBI 


|(CD) (FBI) 


b5 per NSD 
b6 per FBI 
b7C per FBI 




11 / 
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b3 per FBI 
b7E per FBI 










b3 per 
b7E FBI 



ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 05-06-2013 BY C66W46B11 NSICG 


(Rev. 05-01-2008) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 06/28/2016 

To: Washington Field 


From: Washington Field 



Title: im MIDYEAR EXAM; 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 

Synopsis: (U//FWO) Documents details related to the 

investigation's inability to acquire 19 electronic devices 
potentially utilized to access the hdr22@clintonemail.com or 
hrodl7@clintonemail.com e-mail accounts. 



FEDERAL GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(E) 

Do not disseminate except as authorized by federal rule of 
criminal procedure 6(e). 

Details: (U//TOUCH During the course of its investigation, the 

Federal Bureau of Investigation (FBI) identified electronic 
devices with e-mail capability associated with former Secretary 
of State HILLARY RODHAM CLINTON through witness interviews, 

Grand Jury subpoena returns and information provided by 
CLINTON's defense counsel. As of the date of this communication, 
the FBI identified, but was unable to acquire, 19 devices which 
possibly were used to access CLINTON's hdr22@clintonemail.com or 
hrodl7@clintonemail.com e-mail accounts. 


1 


b6 per 
b7C FBI 


b3 per 
b7E FBI 


b3 per 
b7E FBI 




HRC-990 



^SEefsST 

FEDERAL BUREAU OF INVESTIGATION 


(U//TOUO) Unless specifically noted, the FBI was unable to find 
explicit evidence indicating the devices outlined in this 
communication were connected to either the Bryan Pagliano or 
Platte River Networks (PRN) e-mail servers. However, the FBI was 
unable to identify all of the devices that accessed CLINTON'S e- 
mail or synced with the servers due to the limitations of the 
data and log files available from the hardware collected. 


(U) |_ 

_ The author [ 


b5 per NSD 


(U//FOUO-) 


b3 

b6 

b7C per 
b7E FBI 


b3 

b6 per 
b7C FBI 


2 












(U/ /FOUO) Finally, the FBI investigation identified an 
Apple MacBook Pro laptop computer which contained a full archive 
of the e-mails from CLINTON'S tenure as Secretary of State. In 
March 2013, CLINTON'S hdr22@clintonemail.com e-mail address was 
publicly released following the on-line posting of e-mail 
exchanges between CLINTON and an informal political advisor. 


.JSbsseiC 
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’ (Rev. 05-01-2008) 



FEDERAL BUREAU OF INVESTIGATION 


SIDNEY BLUMENTHAL. According to interviews of COOPER and CLINTON 
aide MONICA HANLEY, the event prompted a switch to CLINTON's new 
e-mail account, hrodl7@clintonemail■com , and the creation of an 
archive of CLINTON'S State Department tenure e-mails. In late 
March 2013, HANLEY created an archive of the e-mails in 
CLINTON'S account on an Apple MacBook Pro from HANLEY's New York 
residenc y. HANLEY subse quently shipped the laptop to PRN 


employee 


onto the PRN server. Following[ 


in February 2014 to : 


e the archive 


]migration, he shipped 


the laptop to [" 
manager at | 

laptop fpomj ^_• however, she advised that CLINTON'S staff 


who was CLINTON'S office 
]"lndicated she never received the 


was moving^effives •at the time and it would have been easy for 
the package tl.o^t during the transition period. The FBI 
did not identify location of the Apple MacBook Pro computer. 


♦ ♦ 


.r .VI 

9 


, i ■■. 11 f f ft*. 1 1S f V 

. ■ 1 I , o* 

ill) i A n i i i 


i i 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76318T80 NSICG 




b6 per FBI 
■b7C per FBI 


From: 

Sent: 

To: 

Cc: 

Subject: 


Turner, Katherine [KTurner@wc.com] 
Tuesday. July 05 2016 10:14 PM 

J(NSD) (JMQV Kendall.David 
NSD) (J MD)l 


RE: Attorney Notes 


SD1IJMD)!- 

J(WF) (FBI)l. 



JWF) (FBI) 


JUSAVAE); 


Thanks very much. 


We will let Cheryl and Heather know. 


b6 p« .® 

b7C per." SBI 


Sent with Good ( www.good.com ) 


From: 


(NSD) 

2016 10:11:44 PM 


b6 per FBI 
b7C per FBI 


To: Kendal 

r-Cfij— - 

1. David: Turner. Katherine;! 

| (NSD) J I - 

USAVAE ) J (USAVAE); 

1 

1 (WF) (FBI)^ 

(WF) (FBI) 


b5 per NSD 


David/Katheri 



b6 per FBI 
b7C per FBI 




National Security 


b6 per FBI 
b7C per FBI 


nl . .i 


Phone: 


This message and any attachments are intended only for the addressee and may contain 
information that is privileged and confidential. If you have received this message in error, 
please do not read, use, copy, distribute, or disclose the contents of the message and any 
attachments. Instead, please delete the message and any attachments and notify the sender 
immediately. Thank you. 


l 
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b6 per 
b7C FBI 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 11-10-2016 BY J76J18T80 NSICC 

/ 

U.S. Department of Justice 


Criminal Division 


Washington, D C. 20530 


DEC 2 9 2015 


Special Agent } 1 

Federal Bureau of Investigations 
Washington Field Office 
601 4 th Street N.W. 

Washington, DC 20535 


b6 per 
b7C FBI 


Re: Declination of Bryan M. Pagliano 

Dear Special Agent ] | 

The Public Integrity Section has completed its review of allegations concerning Bryan M. 
Pagliano. 

This letter will confirm that we have concluded that initiation of criminal proceedings in 
this matter is not warranted and we have declined prosecution. We understand that your office 
concurs with this decision. 



b6 per 

b7C DOJ-CRIM 


Public Integrity Section 


ns 
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' : &?3 per 
•#7E FBI 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 HSICG 





b6 per 
b7C FBI 
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-fr^ I 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 NSICG 




b6 per FBI 

- b7C per FBI 

(CD) (FBI) 

b5 per NSD 
b6 per FBI 
b7C per FBI 



b6 per FBI 
b7C per FBI 


HRC-1006 

b3 per FBI 
b7E per FBI 


1. A1489/F9FMW65UFCM9 

2. A1432/F4GJG37XF193 


Thanks. 



From 
Se nt: Friday 
To d 
Cc: 


(NSD 

March 1 1, 201F1T37 

_. (RO) (FBI) 

KNSP) (JMD) 


Subject: iPad Minis 












David E. Kendall, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


Dear Mr. Kendall, 


ALL FEI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 HSICG 


U.S. Department of Justice 

National Security Division 

Washington, D.C. 20530 


July 21,2016 






b6 per 
b7C FBI 
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FD-302a (Rev. 10-6-95) 


ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J18T80 NSICC 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 07/21/2016 


b6 per DOS, FBI 
b7C per DOS, FBI 


On July 21, 2016, Special Agent£ 


^provided 


pf the United States 


Department of State, Diplomatic Security Service, a package containing the fblli vvj% two (2) DVDs: 
“Final Production to U.S. Department of State Disc 1; Datasets 1-3” Disc #D£HQ76 
“Final Classification Determinations” Disc #DEHQ75 


b6 Per 
b7C DOS 


A copy of the FD-597 [Receipt for Property] signed by] 


Acknowledging the receipt of 


said DVDs is enclosed in an accompanying 1A, along with a copy of Disc #DEHQ75 


Investigation on 07/21/2016 


at 


1 $ 


-L 


1 90 

ITS and 


Washington. D.C. 


Date dictated 


N/A 


3y M 


b3 per FBI 
•b7E per FBI 

b6 per FBI 
'b7C per FBI 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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b7C FBI 


ALL FBI IHFCRiiAT I OH CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-10-2016 BY J76J1ST80 HSICG 


UNCLASSIFlED// rO« OFFICIAL USE ONLY 

MEMORANDUM OF UNDERSTANDING 

Between the Federal Bureau of Investigation and the United States Department ofStatc 

Governing Retrieved Materials 

(U) INTRODUCTION 

1. (U//TOfcf0) This MEMORANDUM OF UNDERSTANDING (“MOU”) between the 
Federal Bureau of Investigation (“FBI”) and the United Slates Department of State 
(“DOS”) (collectively, the “Parties”) memorializes and confirms the Parties' agreement 
governing the status and handling of certain information provided by the FBI to DOS in 
furtherance of agency record determinations by DOS. 

• 

(U) DEFINITIONS 

2. (U//FOUO) The “FBI’s Investigation" means the FBI’s investigation concerning a 
referral from the Inspector General of the Intelligence Community (“ICIG”) in 
connection with former Secretary Millary Clinton's use of a private e-mail server. 

3. (U/'/POUO) - “Retrieved Materials” means certain information that the FBI has provided 
or that it may in the future provide to DOS for review and determination of DOS agency 
record status. 

(U) BACKGROUND 

4. (U / / TOU O) During the course of the FBI’s Investigation, the FBI obtained certain 
information that may include DOS agency records. 

5. (U//FOUO) Pursuant to a July 8, 2016 request from DOS. the FBI notified DOS on July 
12, 2016 that it would provide such information for review and DOS agency record 
determination pursuant to the Federal Records Act and for subsequent Freedom of 
Information Act (FOIA) processing as appropriate. 

(U) UNDERSTANDING AND AGREEMENT 

6. (U//F OUQ ) The purpose of this MOU is to express and embody the Parties' 
understanding and agreement regarding the conditions under which the FBI has provided 
the Retrieved Materials to DOS. 

7. (U//F OUQ ) The Parties understand and agree that the Retrieved Materials arc being 
provided to DOS for the purpose of conducting a review and determination of .DOS 
agency record status. 

a. (U/ /EOUO ) During the review, upon DOS’s determination that a document from 
the Retrieved Materials is a DOS agency record, custody of that document will 
immediately transfer to DOS. DOS may then process and use the identified DOS 


I 

UNCLASS1FIEI V/FOW OFF I C I AL U S B O N LY 


HRC-1012 


- 10 / 


b3 per 
b7E FBI 


UNCLASSIFlED// rOR OPflClAL USE ONLY 


agency record for any lawful and authorized purpose, to include responding to 
FOIA requests. 

b. (U//POUQ} Except for those Retrieved Materials that are determined by DOS to 
be DOS agency records. DOS will not, absent written consent of the FBI, disclose 
or disseminate the Retrieved Materials to anyone other than individuals 
participating in. assisting, or supervising the DOS record determination process. 

c. (U//rOUO) Upon completion of DOS’s agency record review, any Retrieved 
Materials determined not to be DOS agency records, apd any copies of such 
Retrieved Materials made by DOS. will be rciun^4jWinc FBI for disposition in 
accordance with FBI policies and procedures, 

8. (U/ / F OUQ) The Parties understand and agree that, until a document within the Retrieved 
Materials is determined to be a DOS agency record, the Retrieved Materials shall not 
constitute DOS agency records under the FOIA or any other law; DOS may not integrate 
the Retrieved Materials into its records filing systems and may not disseminate or use the 
Retrieved Materials for any purpose other than DOS agency record determination; and if 
DOS receives a request for access to the Retrieved Materials from outside DOS under the 
FOIA or any other law or authority, DOS will notify the FBI of the request. 

9. (U//FOUG) The Parties understand and agree that the FBI will mark the Retrieved 
Materials with appropriate classifications to the greatest extent possible, but that the FBI 
was unable to obtain definitive classification determinations for all documents therein. 


Brian J. Egan i\ Date 

Legal Adviser 
U S. Department of State 


£. U) / 



E. W. Priestap 
Assistant Director 
Counterintelligence Division 
Federal Bureau of Investigation 
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On Aug 
States Department of 
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jof the United 


ate, Diplomatic Security Service, a package containing the following two (5) 


FBI 

FBI 


Final Production to U.S. Department of State, Disc 2; Dataset 4 
Final Production to U.S. Department of State, Disc 3; Dataset 5-9 
Final Production to U.S. Department of State, Disc 4; Dataset 10-14 
Final Production to U.S. Department of State, Disc 5; Dataset 15-19 
Final Production to U.S. Department of State, Disc 6; Dataset 20 


A copy of the FD-597 [Receipt for Property] signed b)|_ 
said DVDs is enclosed in an accompanying 1 A. 
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Purpose: Need to understand IT / Email ecosystem to provide further guidance wrt preservation 
requests sent to DoS. 

Questions: What are the primary email systems for each classification level (Unci, S, TS): 

• What type o^^o^piation is conveyed on these systems (i.e., general corns, cables, exec 
communicafi6ns, etc)? 

• How cwgjErsers allocated between systems and how can we identify if a specific person has a 
prt^Me^on a given system? 




• \HfcW is 
rv 


the data stored for each system? 


Jv What is the frequency of backup (i.e. automatic, user initiated), how far back does it go? 

' o Js^jiere is this information stored (i.e., remote server vs. desktop PST) 

• Whatteife retention system for each system? v */v_. 

• Do these systems use the State Messag: 'gar.d Archival Retrieval Tool ( SMART)? ^ ^ 

o How can SMART records be accessed? **** 

• What are the search and capabilities for archived files on each system? 

• Who is a POC for each sys$*i 

• Is there a POEMS equiv for unclass or TS corns? 

• Does POEMS communicate with Siprnet systems, unclass systems, etc? 

• What system would the Secretary of State be on? ' 
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Electronic Messaging 
System) 
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One (1) silver Appl e brand Mac Book Air laptop computer, Serial Number 
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WilmerHale 


September 10, 2015 


National Security Division 
Department of Justice 
Washington, D.C. 201530 


By Email: 
Deal 


b6 

b7C 


b6 

b7C 


Thank you for talking with us on September 8 and 9, 2015, regarding our voluntarily providing 
the FBI two laptop computers and one external hard drive that belong to Justin Cooper. We have 
described these devices (hereinafter ; ‘Mr. Cooper’s computer hardware”) more fully in the 
enclosed document. This letter memorializes our agreement with the government about the 
removal of Mr. Cooper’s personal and business files from Mr. Cooper’s computer hardware. 


As we discussed and as the government has agreed, before providing Mr. Cooper’s computer 
hardware to the FBI. we will remove and securely delete Mr. Cooper’s personal and business 
flies. We will load personal and business files selected by Mr. Cooper onto a new computer 
owned by Mr. Cooper, and he will be free to retain and use that data in the ordinary course 
without restriction. WilmerHale will maintain and securely store a complete copy of all personal 
and business files removed from Mr. Cooper’s computer hardware until such time that we reach 
a written agreement with the government as to what portion we should retain. 

The following files will remain on Mr. Cooper’s computer hardware when it is provided to the 
FBI: (1) Mr. Cooper’s emails to and from Secretary Clinton while she was in office extracted 
from his email files; and (2) back-up copies of Secretary Clinton’s blackberry device. As we 
discussed and agreed regarding our consent for these remaining files on Mr. Cooper’s computer 
hardware: 

1. We authorize the government to possess and review all of Mr. Cooper’s emails to or 
from Secretary Clinton while she was Secretary of State (January 21.2009, to 
February 1,2013). During that lime, Secretary Clinton occasionally sent Mr. 
Cooper emails for hand-delivery to her husband. President Clinton. We are aware 
that some of those emails contain information marked “Attorney Client Privilege.” 

2. We authorize the government to possess files labeled as back-up copies of Secretary 
Clinton’s blackberry device. These files do not belong to Mr. Cooper and we 
therefore lack the authority to consent to an examination of their contents. 

Mr. Cooper’s computer hardware contains one or more files labeled as back-up 
copies of blackberry devices, but that arc not further labeled with an owner’s name. 


Wilmer Cutler Pickering Hale and Dorr 1.1 e. 1X75 Pennsylvania Avenue NW. Washington. DC 20006 
Beijing Beilin Boston Biusseis Denver Fianklutt London Los Angeles Mew York Oxioid i*aio aiic Washington 


HRC-1110 




WilmerHale 


Scpicmber'||^|flT 
Page 2 


b6 

b7C 


As we discussed and as the governmenl has agreed, we will open those files’ for the 
sole purpose of determining whether one or more of them is a back-up copy of 
Secretary Clinton’s blackberry device. Any file determined to be a back-up copy of 
her blackberry device will remain on Mr. Cooper’s computer hardware and be 
provided to the FBI. As with the files labeled with Secretary Clinton’s name, these 
files do not belong to Mr. Cooper and we therefore lack the authority to consent to 
an examination of their contents. 

Mr. Cooper will not transfer, copy, or retain in any form the files that will remain on Mr. 

Cooper’s computer hardware provided to the FBI. 



b6 

b7C 


Our forensics learn wit! first copy these files to an external drive and open and review them in that location. Our 
team will not open those files on the original machine. 
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Juslin Cooper's Computer Hardware 

A. One (I) silver Apple brand Mac Book Air laptop computer. Serial Number 
C02LF01CFM74 

B. One (1) silver Apple brand Mac Book Pro laptop computer, Serial Number 
W89361H6644, and charging cord 

C. One (1) black Seagate brand external hard drive, Serial Number NA5AGV8A, and USB 
cord 
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September 24, 2015 


National Security Division 
Department of Justice 
Washington, D.C. 201530 


By Email: 


Dean 


b6 
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b6 
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Pursuant to our letter agreement with the government dated September 10, 2015, today we 
voluntarily provided the FBI one silver Apple brand Mac Book Air laptop computer. Serial 
Number C02LF0ICFM74 (“Mac Book Air”), that belongs to Justin Cooper. 1 We provided the 
Mac Book Air for the purposes of DOJ/FBPs investigation of Secretary Clinton’s personal email 
accounts. 


As agreed, we have securely deleted from the Mac Book Air Mr. Cooper’s personal and business 
files, and we have overwritten its unallocated space with zeros. WilmerFIalc is maintaining and 
securely storing a complete copy of all personal and business fdgs-yapyed jfrom-foe Mac Book 
Air until such time that we reach a written agreement with the^^^j^^^'-^jj^jyv^ortion we 
should retain. ~ 

The following files remain on the Mac Book Air: (I) Mr. CoQf5%’£tag£$ii^3o 
Secretary Clinton while she was in office extracted from his copies 

of Secretary Clinton’s blackberry device. The attached docum ^^ ^dBbytogr^sf’Retail the 
files remaining on the Mac Book Air. As we agreed on SeplesBi«r ♦K^l^risaSs^our 
consent for the files remaining on the Mac Book Air: ~ 

tn~ ~ m a 

1. We authorize the government to possess and review all of Mr. Cooper’s emails to or 
from Secretary Clinton while she was Secretary of Slate (January 21,2009, to 
February 1,2013). During that time, Secretary Clinton occasionally sent Mr. 
Cooper emails for hand-delivery to her husband, President Clinton. We are aware 
that some of those emails contain information marked “Attorney Client Privilege.” 

2. We authorize the government to possess the files label^M^^ck-up copies of 
Secretary Clinton’s blackberry device. These files do r|||||bng to Mr. Cooper and 
we therefore lack the authority to consent to an examination of their contents. 


1 We will provide the FBI an additional laptop computer and an external hard drive that also belong to Mr. Cooper at 
a later date. 

2 We treated any email addressed to or from Mr. Cooper as his email. As such, the Mac Book Air contains not only 
those emails that were sent between Mr. Cooper and Secretary Clinton, it also contains emails that were addressed to 
both Mr. Cooper and Secretary Clinton (within the same email). 


Beijing 
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The Mac Book Air contained one or more files labeled as back-up copies of blackberry devices, 
but that were not further labeled with an owner’s name. As we discussed and as the government 
agreed, we opened those files 3 for the sole purpose of determining whether one or more of them 
was a back-up copy of Secretary Clinton’s blackberry device. None of those files contained an 
email account belonging to Secretary Clinton. 

Mr. Cooper has not transferred, copied, or retained in any form the files that remain on the Mac 
Book Air. WilmerHale is temporarily holding an image of the Mac Book Air hard drive (which 
includes the files that remain on the Mac Book Air); we created this drive to enable us to restore 
data in the event our forensics team made an error when segregating and removing data. We are 
not aware of our forensics team making any errors, thus we will securely delete the image of the 
Mac Book Air in seven calendar days from today unless you advise us in writing that the files 
listed on the attachment (/.<?., the files remaining on the Mac Book Air) are corrupted or that their 
contents are otherwise irretrievable for reasons that could be cured with the image of the Mac 
Book Air. After we provide Mr. Cooper’s remaining laptop to the FBI, and after a similar 
waiting period, we will degauss the drive that contains the image of the Mac Book Air drive. 

b6 
b7C 


Sincerely yours, 


Enclosure 


1 Our forensics team first copied these files to an external drive and opened and reviewed them in that location. Our 
team did not open th os&Jtks on the Mac Book Air. 
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All items reside in \Users\Jcooper\Desktop (Item numbers have no 
significance; item numbers used here for reference only) 


Item 1 

drwxr-xr-x@ 5 502 20 170 Sep 15 18:15 Archive_email.mbox 

Item 2 

dr-xr-xr-x 1161 502 20 39474 Sep 16 12:45 Archive_email_documents 

Item 3 

-rw-r--r-- 1 502 20 66559 Sep 21 11:45 Archive_responsive_2009 

Jan and Feb.rtf 


Item 4 

-rw-r--r-- 1 502 20 5641 Sep 21 12:05 Archiveresponsive 2009 

Marphi-y-t f 

Itesa .%• 

-rw-r--r-1 502 20 17040306 Feb 26 2013 HR BlackBerry Bold 

9900.ipd 


Item 6 

-rwxrwxrwx 1 502 20 25446688 Apr 13 2009 hrc 

Backup-(2009-04-13).ipd 


Item 7 

-rw-r--r-- 1 502 20 26283514 Nov 26 2011 hrc BlackBerry Curve 

(24B603D0) (2011-11-26) - Full.bbb 


20 170 Aug 15 12:39 hrc saved 


Item 8 

drwx- 5 502 

Item 9 

-rw-r--r-- 1 502 

Item 10 

-rw-r--r-- 1 502 

Item 11 

-rw-r--r-- 1 502 


20 385147 Nov 26 

20 385147 Nov 26 

20 385147 Nov 26 


2011 hrc saved.bbb 


2011 hrc saved.xml 


2011 hrc saved.zip 
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October 5, 2015 


National Security Division 
Department of Justice 
Washington, D.C. 201530 
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By Email: 


Dead 
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Pursuant to our letter agreemuui with the J^nenl toed September 10 2015 today we 
accounts^ ** **** of DOWB ''^ investigation "' S.cutarv Canton's pensonal em a i> 

Kr^s^s,“2s:5~r^si;t-; b '"" s r 

socurcly storing a comp,ete copy of all personal and business MbSved STm'S 
t,mC ‘ ha * WC rCaCh 3 Wllte " intent with the governs, as to wtt pontte 

rnnmnH Win8 k eS rCmain °H MacB °° k Pr0: 0) Mr - Cooper’s emails 2 to and from Secretary 
Clinton during her tenure as Secretary of State extracted from his email files- and (2) back un Y 

detaiTthc n ' Chni ° n ' S blackberr y devic e. The attached document describes in greater 

as follows rema,nm8 ° n thC MaCB °° k Pr °- WC reS0,Ved several -■«*« for the MacBook Pro 

iden.ir!l ?V 13Sh determined that two text files on the MacBook Pro were 

identical to two MacBook Air provided to the FBI on September 24 

n ° r J p A * we a 8 r ^ d >- because those files are identical and had therefore already been 
preserved in Kroil S; p^S3irfg of the MacBook Air, we did not review and save the 
responsive portions of those two files on the MacBook Pro. 

Again using MD5 hash values, Kroll determined that two text files on the MacBook Pro 
were identical to each other. As we agreed, because those files wereta.caTto each 
other, Kroll processed only one of them. t0 Cach 


2 Wc Wl fjf|i ,e lhc FBI an CXtcrnal hard drivc that a| so belongs to Mr. Cooper ai a later dale. 

Mr^Cooper 2?g*£cto.A T' "* M “ U “ l P ™ « only 

bolh Mr. Cooper ai|^crc!ary Clinlon (within the same email). ’ ** S ° Cont ‘" ns cma,ls ,hiU were addressed lo 
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Page 2 


WilmerHale 


b6 

b7C 


• Like the MacBook Air, the MacBook Pro contained files labeled as back-up copies of 
blackberry devices, but that were not further labeled with an owner’s name. Kroll 
matched those files to igflabeled blackberry back-up files on Mr. Cooper’s MacBook 
Air using MD5 hash v3|§^- As described in my letter of September 24, 2015, Kroll had 
previously determined tfiose files on the MacBook Air did not contain an email account 
belonging to Secretary Clinton. 

As we agreed on September 10, 2015, regarding our consent for the files remaining on the 
MacBook Pro: 


• We authorize the government to possess and review all of Mr. Cooper’s emails to or from 
Secretary Clinton while she was Secretary of Stale (January 21,2009, to February 1, 
2013). During that time, Secretary Clinton occasionally sent Mr. Cooper emails for 
hand-delivery to her husband. President Clinton. We are aware that some of those emails 
contain information marked “Attorney-Client Privilege.” 3 

• We authorize the government to possess the files labeled as back-up copies of Secretary 
Clinton’s blackberry device. These files do not belong to Mr. Cooper and we therefore 
lack the authority to consent to an examination of their contents. 

Mr. Cooper has not transferred, copied, or retained in any form the files that remain on the 
MacBook Pro. WilmerHale is temporarily holding an image of the MacBook Pro hard drive 
(which includes the files that remain on the MacBook Pro and the text files described above) to 
enable us to restore data in the event our forensics team made an error when segregating and 
removing ckta. We are not aware of our forensics team making any such errors, thus we will 
securely di'ete the image of the MacBook Pro and degauss the drive in seven calendar days from 
today unless the government advises us in writing that the files listed on the attachment (i.e., the 
files remaining on the MacBook Pro) are corrupted or that their contents are otherwise 
irretrievable for reasons that could be cured with the image of the MacBook Pro hard drive. 


b6 

b7C 



’Because Mr. Cooper’s emails contain information marked “Attorney-Client Privilege," David Kendall counsel to 
Secretary Clinton, is reviewing Mr. Cooper’s emails. 
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ATTACHMENT 

JG Cooper MacBook Pro // 10022015 

(Item numbers have no significance; used here for sake of reference) 

Item 1 

hre saved 2 

macbook pro\Single Files\pro -'rcsponsivc\hrc saved 2 

Item 2 

hre BlackBerry Curve (24B603D0) (2011-11-26) - Full.bbb 

bbb 10/2/2015 0:00 10/2/2015 16:49 Ic3c62e765f7b85d9cc35f3c0cf57f7e 

macbook pro\Single Files\pro - responsivc\hrc BlackBerry Curve (24B603D0) (2011-11- 
26)-Full.bbb 

Item 3 

hre saved.bbb 

bbb 10/2/2015 0:00 1 0/2/2015 16:49 bca9c5661494e 15c 1 aa 1 f8902ce9ab 11 

macbook pro\Single Files\pro - responsivc\hrc saved.bbb 

Item 4 

HR BlackBerry Bold 9900.ipd 

ipd 10/2/2015 0:00 10/2/2015 16:49 acaf592275644075510cf53110df4567 

macbook pro\Single Files\pro - responsive\Mail Download\HR BlackBerry Bold 
9900.ipd 

Item 5 

hre saved (folder) 

Item 6 

hre Backup-(2009-04-13).ipd 

ipd 1 0/2/2015 0:00 10/2/2015 16:49 aftadl 10a4falDfa4234fa6151675f6f 

macbook pro\Single Files\pro - responsivcVhrc Backup-(2009-04-13).ipd 

Item 7 

Archive_email.mbox 

mbox macbook pro\Single Files\pro - responsive\Archive_email.mbox 


HRC-1128 



Responsive - PC Mail - Sent Itcms.mbox 


mbox macbook pro\Single Filcs\pro 
Itcms.mbox 


- responsive\Responsive 


- PC Mail - Sent 


Item 9 


responsive PC Mail inbox old server inbox.rtf 

mlhn l 072 ^ 15 ?^ 0 , 4 10/2/2015 16:49 18ed6542b5e4ab3f69384bdbbe7d3fa2 

macbook pro\Single Fdes\pro - responsivc\responsive PC Mail inbox old server inbox.rtf 


Item 10 


responsive PC Mail Inbox.rtf 

I 0 *™ 5 ™ 0 . , ‘0/2/2015 16:49 ac71599abc6d62ff95482ce7c8012f9a 

macbook pro\Single FiIes\pro - rcsponsive\responsive PC Mail Inbox.rtf 


Item 11 

hre saved.zip 

zip 10/2/2015 0:00 10/2/2015 16:49 bca9c566I494el 5cl 

macbook pro\Sing!e Files\pro - responsivc\hrc saved.zip 


aalf8902ce9abl 1 


Item 12 

lire saved.xml 


10/2/2015 0:00 10/2/20)5 16:49 bca9c5661494el5claali8902ce9abl 

macbook pro\Single Files\pro - responsivc\hrc saved.xml 


Item 13 


Mail Download 

macbook pro\Sing!c Files\pro - responsive\Mail Download 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-17-2016 BY J76J18T80 HSICG 


mm. 


From: 

1 

Sent: 

Fridav. November 

To: 

1_1 

Subject: 

Case email 

Follow Up Flag: 

Follow up 

Flag Status: 

Flagged 

io#-.;:for 


FW: 2003 Cable 


Or 



]oig£ 


Senior Special Agent 
Office of Investigations 
Office of the Inspector General 
US Department of State 
office 
cell 


b6 per DOS, FBI 
b7C per DOS, FBI 


b6 per DOS, FBI 
b7C per DOS, FBI 
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File Number 


Field Office Acquiring Evidence 
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Date 




nJb 


From 





(Name ol Comributor/lnterviewee) 


(Address) 


To Be Returned D Yes 
Receipt Given 0 Yes 

Grand Jury Material - Disseminii£-«J;ri> Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes Sfl^lo 

•Federal Taxpayer Information (FTI) 

0 Yes 




Title: 


r 

i 

b3 

b7E 


i IVv 

b6 i\. - . 

b7C V. 

• ' V 

. )• 

'• \ • ; 


V 



b6 

b7C ! 


tKLb'iGA'V- 5XAH) 

» CiAfrtttBb 


Reference: 


(Communication Enclosing Material) 


Description: D Original notes re interview of 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 11-17-2016 BY J76J18T80 NSICG 



1. Date (rrm-dd-yyyy) 2. Action 
10-29-2015 

I 


4. Loan Information 

Date Loan Ends (mm-dd-yyyy) 


5. Requestor's Name (Print Name) 


U.S. Department of State 

PROPERTY TRANSACTION 


□ Issue □ Realization 

□ Turn In □ Loan S Transfer 


3. Control Authorization Number 


Date Loan Returned (mm-dd-yyyy) 


6. Agancy/Bureau 7. Office I 8. Room Number 9. Telephone Number 

FBI I 


10. Justification or Remarks 

Desktop turned over to FBI as part of an ongoing investigation 

11. Authorizing Officer {Print Name) 112. Signature 


13. Approving Officer (PrlntName) 


15. Deliver or Ship to (Ust Registry Information If 


16. Property Details 


Property Number Serial Number 


DSD003540 I 2UA9261HHK 


Description 


17. Property Re<»rds 
Records Updated by 



T _ -29-IS 

I * - ii^ptmdd-yyyy) 

/0-Vz^VS 


b6 per 
b7C DOS 



Quantity | Condition I Unit Cost 


good 



(Initials) 


Date (mrrbdd-yyyy) 


IB. I hereby acknowledge receipt of the Items of property listed above. I understand that I am financially liable, In accordance with14 FAM 411.2-9 
and 423.8, for the value of any property Issued or loaned to me. 


Received By ( Print Name) 


Signature 


Date (mm-dd-yyyy) 


(User Name) 


DS-0584 

08-2015 


HRC-1162 
























(i.) iDgia 

Enter the date the form DS-584 Is prepared. 

(2.) Action 

Enter an "X" In the select action field to Indicate the type of property action. 

• Issue - asset(s) Issued to or moved from the warehouse or storage facility to an employee, office, residence, or other location. 


• Turn In - assess) turned In or moved 4orp 

• Loan - assetfs) provided to an entity (see) ifjttljgji'! {■ 

• Reutlllzatlon - the movement of an asset :'i ■!'v, ?■ 

| or post to another bureau or post .I XJ K} 

• Transfer - the movement of asset(s) from' ft 

(3.) Control/Authorizatlon Number (j j I M ‘ 
[System generated by ILM5. < § 0 ! 


lEnter the date the loan ends and the 


Enter the name of the receiving agency/ 


«£/ n 5 

r r V ♦ 



location back to the warehouse or storage facility 
rlod of less than 90 days and/or no more than a year, 
to another. The movement of an asset from one bureau 


Hft; itle Is passed. 


Enter the'name of the receiving agency/post/bureau. 
(7.) Office 

Enter the name of the office. 


Enter the room number. 


Enter the telephone number of the receiving agency/post/bureau contact 


Enter the reason for the request and any other Item specific details. 


(11.) Authorizing Officer (Print Name) 
Enter the authorizing officer name. 


Enter the authorizing officer signature and date (14 FAM 411.2, 14FAM414, and 14 FAM 425). 


Enter the approving officer name. 


Enter the approving officer signature and date (14 FAM 411.2,14 FAM 414, and 14 FAM 425). 
Denver or Shin to (List Registry Information ) 

The delivery address of the agency to which the property is being transferred. 

PrepolYPeftile 

Property Number - 

Enter the nonexpendable property application (fag) property number. 

Serial Number - 
Enter any serial number. 

Description - 
Enter description. 

Quantity - 

Each line will be a one-item entry. 

Condition- 

Indicate the condition of the property. 

Unit Cost- 
Enter the unit cost 
Total Cost - 
Enter the total cost. 


DS-0584 

08-2015 


Update property records. 

(18.) Receipt 

The receiving agency's employee signs and dates (14 FAM 413.3 


Instruction page 1 of 1 
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Page 
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File # 


UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 
Receipt for Property Received/Returned/Released/Seized 


On (date) 


(Name)_ 


\o\z^2oiS' 


itemfe) listed below were: 
[g^Received From 
Q Returned To 

□ Released To 

□ Seized 
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. ALL INFORMATION CONTAINED 
' HEREIN IS UNCLASSIFIED 

DATE 10-25-2017 BY C66W46B11 NSICG 


o 


FtVJ40(Rev.4-ll-0J) 

File Number _ 


Field Office Acquiring Evidence _ V>. 


Serial # of Originating Document _i_ 
Date R eceived M / ^> / 




From 


rviewee) 


7-1 sT JU.UJ ■ 


[~^>Q7-' b7E 


i 

, 

b6 \ 

b7C ‘A. 

• a. 


(Address) 

UiA-st^^C-fro-I Tor - 


(City and Slate) 



To Be Returned □ Yes 

Receipt Given □ Yes 0 No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes ' . ‘ft No 

Federal Taxpayer Information (FTT) 

□ Yes '/Tno 


Tide: 


iKk [tz*{gA¥— 


Reference: ' 


(Communication Enclosing Material) 


b6 

b7C 


A . 


•• •!' 


De scription: Original notes re interview of 


b6 

_b7C 
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FD-340 (Rev. 4-11-03) 

File Number 


~2>02- 


Ficld Office Acquiring Evidence 
Serial # of Originating Document 
Date 1 
From 


Wf 




U-l be^.cflW^ 

1 / A HHrpc 


(Address) 


n fl'tTTR.- PC— 


f 


(City and Stale) 


By 


To Be Returned □ Yes , 

JP«c««S>t Given □ Yes El^o 

Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes • C^o 

Federal Taxpayer Information (FTI) 


□ ^ Yes 




Reference 


kycL*'” 

: • |ryKcJrf~J NdfC-S 


(Communication Enclosing Material) 


Description 


iption: W 


Original notes re interview ofj 


\ 0(0 


b3 
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b6 ;.\ 
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■ t • 
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UNCLASSIFIED 
U.S. Department of State 
Case No. F-2015-04841 
Doc No. C05739666 
Date: 05/13/2015 


STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZI COMM. 

SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. 


ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-17-2016 BY J76J18T8D NSICG 


RELEASE IN 
FULL 


From: 

Sent 

To: 

Subject: 


Abedin, Hume <AbedinH@state.gov> 
Sunday. April 10,201110:14 AM 
H 

Fw: Stevens Update (Important) 


Importance: 


High 


Jake may have sent but In case not.. 




— Original Message — 4,0 \K ^ 

From: Davis, Thorny T \tT ? v' 

Sent: Sunday, April 10,201106:48 AM */ 

To: Sullivan, Jacob J; Abedin, Huma; Wells, Alice G; S_Specla I Assistants 
Subject: Stevens Update (Important) 


(SBU) Per Special Invoy Stevens: 


The situation In Ajdablyah has worsened to the point where Stevens Is considering departure from Benghazi. The 
envoy's delegation Is currently doing a phased checkout (paying the hotel bills, moving some comms to the boat, 
etc). He will monitor the situation to see if It deteriorates further, but no decision has been made on departure. He will 
wait 2-3 more hours, then revisit the decision on departure. 

He received reports of shelling last night in Ajdabiyah as well as snipers shooting people In the city. AFRICOM 
reported Qadhafi's forces took the eastern and western gates of Ajdablyah, with S vehicles at the eastern gate and 50 at 
the western gate. More Qadhafl forces are heading to Ajdabiyah from Brega. 

The Brits report Qadhafi forces are moving from Slrte to Brega, which they Interpret as preparation for another 
assault on Ajdabiyah today. 

He plans to discuss the situation further with the Brits, Turks, and the TNC to see if this is an irreversible 
situation. Departure would send a significant political signal, and would be interpreted as the U.S. losing confidence In 
the TNC. Initial message to the TNC would frame the departure as due to security grounds and as a temporary measure 
only. 


Polaschlk said she would discuss these developments with Amb. Cretz. 

If the group departs, the contract for the boat stipulates they return to Greece. One scenario be the group 
stages elsewhere for a few days. 


Ops will continue to monitor the situation. 


UNCLASSIFIED 
U.S. Department of State 
Case No. F-2015-04841 
Doc No. C05739666 
Date: 05/13/2015 
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STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZI COMM. 

SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. 
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• ALL FBI INFORMATION 
HEREIN IS UNCLASSIFIED 
DATE 11-17-2016 BY J76 


PD-340 (Rev. 4-1 t-OJ 

File Number I 


Field Office Acquiring Evidence _jAJj 

Serial # of Originating Document- 

Date Received 11 - 2 - 3 ~ 75” 


I ATJg 


3o 


3b 

• ®*f i££a* 


(Name of Contributor/lnlcrviewee) 


(Address) 


To Be Returned □ V- l^No 

Receipt Given D No 

Grand Jury Material - Pursuant to Rule 6 (e) 

Federal Rules of Crimr^jP^CJS^ 

i^Vjo 

Federal Taxpayer information (FTI),. 

"W-AjQ’Yes 1 QTfo 


Reference: No4tf J -__ 

(Communication Enclosing Material) 


Description: ^ . Original notes re interview of 











UNCBWSRfiEoI 
U.S. Department of State 
Case No. F-2015-04841 
Doc No. C05739808 
Date: 05/22/2015 


(U) 

STATE DEPT - PRODUCED TO HOUSE SELECT BENGHAZI COMM. 

SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION 8 REDACTIONS. NO FOIA WAIVER. 

FBI INFO. 

CLASSIFIED BY: HSICG J76J18T80 
REASON: 1.4 (C) 

DECLASSIFY ON: 12-31-2037 
DATE: 11-17-2016 


RELEASE IN PART 
B1,B7(D),B7(E),1.4(D),B7(A), 


From: 

Sent 

To: 

Subject 


Su1§vfc\J«sbab J <SulRvanJJ@state.gov> 

- 5fcK?mber 18,2012 8:44 PM 

m: of arrests -- possible Benghazi connection 


B7(A) 





This preliminary, 


t Benghazi connection 

>&. Pvrs /m£ '\. 

t very interesting, pbfss fellow. FBI in Tripoli is fully involved. 


From^ - | 

Sent: Sunday, November 18, 2012 07:0 1 PM 
To: Jones, Beth E; Maxwell, Raymond D;| 
Subject: FYI - Report of arrests ~ possffiffi WET 


ingraa connection 


b6 per FBI 
b7C per FBI 


b6 per FBI 
b7C per FBI 


I • 

-bl per DOS, FBI 
b3 per FBI 
b7A per DOS 
b7D per DOS 
b7E per DOS 


Post reports that Libyans police have arrested several people today who m pv/mav have some connection to 
the Benghazi attack. They were acting on Information furnished bv DS/I 


0 may/ 

fisdZ 


: b7 ( e > 


Overall, 

-’dim n luuiu tudu iu news dLUjuriti irum Lioya bayifig there 


|1.4( D ) ,S) 
B7(D) 


mis luuiu igju m suiinrmmg upw^uuiidi iy, uj jimT’gm 
is a significant break in the case, ornot. |\ _ 

^9 K) Ot? Onef- of K-i^irn i>ipS"U 

(p<rboJc?\j\ bxifJ- r* FhrntUU) __ 

Classified by DAS, A/GIS, DoS on 05/2272015 - Class: SECRET/NOFORN - 
R- : 1.4(D) ~ Declassify on: 11/18/2032 


At this point, just FYI. 


Department of State 


e^Vj d.(U/j 


b6 per FBI 
b7C per FBI 


JJHCtAeStOgD 
U.S. Department of Slate 
Case No. F-2015-04841 
Doc No. C05739808 
Date: 05/22/2015 
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STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZI COMM. 

SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER 
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UjcOtsStSEtT 

y.$. department of State 
CtswsNo. F-2015-04841 
CwsNo. C05739808 
Date: 05/22/2015 


STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZI COMM. 

SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. 


FBI INFO. 

CLASSIFIED BY: NSICG J76J18T80 
REASON: 1.4 (C) 

DECLASSIFY ON: 12-31-2037 
DATE: 11-17-2016 


RELEASE IN PART 
B1,B7(D),B7(E).1.4(P),B7(A) 


87(A) 

B7(E) 


From: 

Sent: 

To: 

Subject 


Sullivan, Jacob J <Suttrvan»J@state.gov> 

Sunday, November 1ft 2012 8:44 PM 
H 

Fw: FYI - Report of arrests -- possible Benghazi connection 



Jo^StthE 







18. 2QL? 07-14 ptA 
__£j|iiiv.in, Jacob J 


b6 per FBI 
b7C per FBI 


aibject/fw: FYI - Report at ants*“••jKS'.fck Benghazi connection 

This preliminary, but very interew.’^ assis* bslow. FBI In Tripoli is fully involved. 


From: Roebuck, WBIlam V 
Sent: Sunday, November 18, 2012 07:0} PM 
To: Jones, Seth E; Maxwell, Raymond D 
SubJect:/FYI - Report gf arrests 

Post reports that Libyans police have arreireu Several people today who mpv/mav haw mmc mnnortinn tn 
the Benghazi attack. They were acting on Information furnished by PS/ 



bl per DOS, FBI 
b3 per FBI 
■b6 per FBI 
b7A per DOS 
b7C per FBI 
■b7D per DOS 
b7E per DOS 



B7(E) 


__.14(D) 

|Overall, 'Bl 

tms could fead to something operationally, not, a."c ifcs-w?< accounts from Libya saying there B7(D) 
is a significant break in the castor not. 

At this point, just FYI. 


_ 

, . pastffcW hg BAS, Oos on 05/22/2015 - Classi^CagTfN OrOR N 

j‘p£* /V |Re*sg?i : on: 11/18/2032 _ 


bW 3 






Department of State 
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LTs. Department of State 
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Date: 05/22T2015 
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AAA FBI IKBOBSi&TIdSi CONTAINED 

HSH2IS.XS TiTSCIAaSiriED 

IJATZ 12-17-591*' 3X J76J18T80 NSICG 



Current 


Former: Director 


Introduction 

o Voluntary/Can stop at any time 

o NSLB Disclaimer re: Garrity / not interested in prior statements to DOS 

o FBI's interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. FBI is sensitive to conflicting opinions on the classification of 
materials - same info from two sources may hrye different classification levels based 
solely on the source of the info, i,e., siglnt vs. diplomatic liaisons. ^ i pj 

Brief overview of role(s) between 2/05 &.ic 

o Y u.d, "n: on what information is forwarded 

, ... — 

o Access to / training on handling uf classified information. _ 

■ Guidance on handling classified leaks, £?r jiries from press f "ofc 

Knowledge of the server l 

o Frequency of emails to/ from \ 

o Guidance on sending material to the server 

o Procedure for communicating classified information to the Secretary (if applicable) 

■ Did it vary when she was traveling, in NY, etc. 

o Concerns with the use of the server or other communication channels 
Discussion of specific email(s) _ 

o ICIG believed that classified information may be contained in email sent 

Subject: FYI - Report of Arrest... sent Sunday, Nov 18, 2011 to multiple parties, 
forwarded to Sullivan, then to Secretary 
Details surrounding the email chain in question. 

■ What was the source of the information cited 

■ Knowledge of information being sent to the Secretary 

• Was the information communicated via other channels as well 
• How, Why 

■ Typical of other communications made via email? 

Any other thoughts / concerns regarding this matter. 

NDA request 


I icveii udueu * 

{ -xk***- 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-17-2016 BY J76J18T80 NSICG 




ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 11-17-2016 BY J76J18T80 NSICG 


l : 

b6 

b7C 


• introduction 

o Voluntary/ Can stop at any time 

o NSLB Disclaimer re: Garrtty/ not Interested in prior statements to DOS 
o FBI's interest In this matter Is to assess whether classified Information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. FBI is sensitive to conflicting opinions on the classification of 
materials - same info from two sources may have different classification levels based 
solely on the source of the Info, i.e., sigint vs. diplomatic liaisons. 

b6 
b7C 

> 

' 

| ' 

• Role of Watch Offlcer/Senior Watch Officer 

• Training 

• Chain of command 

i' 

• Guidance on what information is relevant/forwarded 

• How is information pushed forward (verbally/email) i 

• Who receives Information from the Watch? How? 

• Use of listservs - access to check? Typical delivery? 

» How is watch Information documented/archived? 

• Who Is responsible? Who has access? 

• Access to / training on handling of classified 

• Ever push classified from classified to unclassified? 

o Frequency? Directed? Protocol for doing so? 

• Guidance on press inquiries/leaks of classified information 

■ Explanation of 'The Line?" 

• Knowledge of the server 

o Frequency of emails to /from HRC 
o Guidance on sending material to the HRC server 

o Prod^p$>r communicating classified Information to the Secretary (if applicable) 

• Sf?lt vary when she was traveling. In NY, etc. 

■ If not direct to HRC, who did you email? 

■ Extent of Interaction/relationship with Huma Abedin, Jake Sullivan 
o Concerns with the use of the server or other communication channels 

• Discussion of specific email(s) 
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ICIG bel ieved that classified information may be contained in email sent bj 


] Subject: Summary of 1055 EDT DPRK Conference Call sent Friday, July 3,2009 


to SES_DutyDeputies,[_ 

E. Macmanus, and Cc: SES-OSWO-Only^_ 


SSperia I Assistants, Joseph 
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■ Details surrounding the email chain in question? 

■ Background on "DPRK conference call" 

• How did you come to learn of the call? J 
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National Security Division 
Department of Justice 
Washington, D.C. 201530 
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Pursuant to our letter agreement with the government dated September 10, 2015, today we 
voluntarily provided the FBI one black Western Digital brand My Passport Ultra external hard 
drive, Serial Number WXG1AA3M2130 (“WD Passport Drive”),' containing certain data 
requested by the government. We provided the WD Passport Drive for the purposes of 
DOJ/FBI’s investigation of Secretary Clinton’s personal email accounts. 


The WD Passport Drive contains the following files: 

1. Mr. Cooper’s emails 2 to and from Secretary Clinton during her. tenure as Secretary of 
State extracted from a copy of Mr. Cooper’s personal and busk&ss? files from his 
MacBook Air and MacBook Pro laptop computers.' 

As you know, we voluntarily provided the FBI with Mr. Cooper’s MacBook Air and MacBook 
Pro on September 24, 2015, and October 5, 2015, respectively. Each machine contained Mr. 
Cooper’s emails to and from Secretary Clinton during her tenure as Secretary of State extracted 
from email Hies contained on those machines (along with back-up copies of Secretary Clinton’s 
Blackberry device). Per our agreement with the government, Kroll identified those emails using 
the spotlight tool that was native to the laptops and worked exclusively on the laptop, /.<?., Kroll 
did not load or use any forensic tools to identify and isolate these emails. 

WilmerHale retained a complete copy of Mr. Cooper’s personal and business files removed from 
his MacBook Air and MacBook Pro by creating a “Time Machine” copy of those files. We then 
reviewed those Time Machine copies using forensic tools and identified Mr. Cooper’s emails to 
and from Secretary Clinton that are contained on the WD Passport Drive. We have securely 
deleted these emails from the personal and business files retained by WilmerHale. 


1 The WD Passport Drive is encrypted; we provided the password to the FBI. 

2 We treated any email addressed to or from Mr. Cooper as his entail.- As such, the WD Passport Drive contains not 
only those emails that were sent between Mr. Cooper and Secretary Clinton but also contains emails that were 
addressed to both Mr. Cooper and Secretary Clinton (within the same email). This letter refers to such email as 
“responsive” if it was also dated between January 21,2009, and February 1,2013 (Secretary Clinton’s tenure as 
Secretary of State). 


Wilmcr Curler Pickering Hale and Dorr t.u\ 1875 Pennsylvania Avenue NW, Washington, DC 20006 
Beijing Berlin Boston Brussels Denver Frankfurt London Los Angeles New York Oxford Palo Alto Washington 
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We believe that we previously produced a majority, likely a vast majority, of the emails on this 
portion of the WD Passport Drive and that our Time Machine inadvertently captured them as 
emails that were not produced. Our use of forensic software enabled us to identify, isolate, and 
remove them from the Time Machine. 

2. Mr. Cooper’s emails to and from Secretary Clinton during her tenure as Secretary of 
State, as well as backup copies of Secretary Clinton’s Blackberry devices, extracted from 
an archival image of Mr. Cooper’s MacBook Air laptop computer dated December 30, 
2013 (“12/30/13 Image”). 

WilmerHale is maintaining and securely storing a complete copy of all personal and business 
files removed from the 12/30/13 Image until such time that we reach a written agreement with 
the government as to what portion we should retain. WilmerHale is also temporarily holding a 
complete copy of the 12/30/13 Image. We will securely delete that complete copy in seven 
calendar days from today unless you advise us in writing that the files on the WD Passport Drive 
are corrupted or that their contents are otherwise irretrievable for reasons that could be cured 
with the copy we retained. 3 

3. Mr. Cooper’s emails to and from Secretary Clinton during her tenure as Secretary of 
State, as well as backup copies of Secretary Clinton’s Blackberry devices, extracted from 
an archival image of Mr. Cooper’s MacBook Air laptop computer dated August 30, 2015 
(“8/30/15 Image”). 

This set of emails includes Mr. Cooper’s emails to and from Secretary Clinton during her tenure 
as Secretary of State extracted from backup copies of Mr. Cooper’s Blackberry devices. By 
comparing MD5 hash values, Kroll determined that other known backup copies of Mr. Cooper’s 
Blackberry devices were forensically identical to those on the 8/30/15 Image, for this reason, as 
we agreed with the government: (1) Kroll isolated (and we have produced) responsive emails 
from backup copies of Mr. Cooper’s Blackberry devices located only on thi?. 8/30/15.Image; and 
(2) we are retaining the noil-responsive portion of the backup copies of MnCjjp.peiXS lack berry 
devices with responsive emails from only the 8/30/15 Image. 

Wilrillitle is maintaining and securely storing a complete copy of all personal and! business 
files removed from the 8/30/15 Image until such lime that we reach a written agreement with the 
government as to what portion we should retain. WilmerHale is also temporarily holding a 
complete copy of the 8/30/15 Image. We will securely delete that complete copy in seven 


3 As you know, we temporarily held images or the MacBook Air and MacBook Pro drives (including files that 
remained on those machines when they were delivered to the PBI) for the same purpose. You subsequently advised 
us that the FBI was able to open the files on those machines and we therefore securely deleted those images. 
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calendar days from today unless you advise us in writing that the files on the WD Passport Drive 
are corrupted or that their contents are otherwise irretrievable for reasons that could be cured 
with the copy we retained. 

As we agreed on September 10, 2015, regarding our consent for the files remaining on the WD 
Passport Drive: 

• We authorize the government to possess and review all of Mr. Cooper’s emails to or from 
Secretary Clinton while she was Secretary of State (January 21,2009 to February 1, 
2013). During that time, Secretary Clinton occasionally sent Mr. Cooper emails for 
hand-delivery to her husband, President Clinton. We are aware that some of those emails 
contain information marked “Attorney-Client Privilege.” 

• We authorize the government to possess the files labeled as back-up copies of Secretary 
Clinton’s Blackberry device. These files do not belong to Mr. Cooper and we therefore 
lack the authority to consent to an examination of their contents. 

We staled in our letters dated September 24, 2015, and October 5, 2015, that Mr. Cooper had not 
transferred, copied, or retained in any form the files that remained on the MacBook Air and the 
MacBook Pro. We have since determined that the 12/30/13 Image and the 8/30/15 Image 
described in this letter contained duplicates of certain files we provided to the FBI on the 
MacBook Air and MacBook Pro. As noted above, those files are contained on the WD Passport 
Drive; we will not transfer, copy, or retain those files except as described above. In addition, we 
have determined that our review/production protocol isolated and produced Mr. Cooper’s emails 
to and from Secretary Clinton, but generally did not lead to us isolating and producing duplicates 
of those emails that were contained in longer chain emails that did not otherwise satisfy the 
criteria of your request. As you have requested, we are isolating those email chains for 
production. 
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From: [ 



Sent: 

Mondav. December 07. 2015 2:54 AM 

To: 

Cc: 




Subject: log 


For some reason I cannot find your email requesting I look for my phone logs. But i remember that I owe you a 
response. I have looked through the logs and records I kept. Unfortunately I only kept my notebooks right around and 
just after the Benghazi incident, i.e., in August and September 2012.1 do n't have any notebooks for later months. Sorry. 
Please let me know if there is anything else I can do. Regards, 
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ICONSULT POD, CIA| 
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From: 

Sent: 

To: 

Cc: 

Subject: 


H <hrod17@clintonemail.com> 

Sunday, September 13, 2009 7:48 AM 
'millscd@state.gov' 

'sullivanjj@state.gov'; 'abedinh@state.gov' 

Re: For S -- for discussion on Afghanistan tomorrow 


Yes. Thx. 

— Original Message — ", 

From: Mills, Cheryl D <MlllsCD@s^i&&> 

To: H 

Cc: Sullivan, Jacob J <SulllvarUJ@state.gov>; Abedln, Huma <AbedinH@state.gov> 
Sent: Sun Sep 13 07:47:17 2009 

Subject: FW: For S - for discussion on Afghanistan tomorrow 


Is this what you are speaking of? 


■—Original Message— 

From: Slaughter, Anne^Jarte 
Sent: Satu rday, S^ ptgmber 1^2009 9:23 PM 

To. MtitsTCKeculD: SullivaiUacob^. _ 

Cc [ Abedin, Huma 

Subject: For S^fr^discussiorMjfr ArgTiaTTtstsrrtormjrrov^ 


•fo doun dwt/Tninc 

$ IrtKaJ- One cU dnj 


* 


I had a Inna talk mill 
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Introduction 

o Voluntary/Can stop at any time 

o NSLB Disclaimer re: Garrity / not interested in prior statements to DOS 
o FBI's interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. FBI is sensitive to conflicting opinions on the classification of 
materials - same info from two sources may have different classification levels based 
solely on the source of the info. 




• 
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press 


o 

o 


o Access to / training on handling of classified informs^fis: 

■ Guidance on handling classified leaks, or i 
Knowledge of the server 

o Frequency of emails to/from 

Guidance on sending material to the server 

Procedure for communicating classified information to the Secretary (if applicable) 

■ Did it vary when she was traveling, in NY, etc. 
o Concerns with the use of the server or other communication channels 

Discussion of specific email(s) 

o ICIG believed that classified information may be contained in email sent by Slaughter 
(subject "For S - for discussion on Afghanistan tomorrow') 
o Details surrounding the email chain in question. 

■ What was the source of the information cited 

• I -1 " ^ , 

■ How did you communicate sensitive / classified information 

■ Typical of other communications made via email? 

Any other thoughts / concerns regards^'iSig matter. 

NDA request 
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Introduction 

o Voluntary/Can stop at any time 

NSLB Disclaimer re: Garrity / not interested in prior statements to DOS 
FBI's interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. FBI is sensitive to conflicting opinions on the classifscaivswa of 
materials - same info from two sources may have different classificatio s • :> based 
solely on the source of the info, 
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O 


■ Frequency and method of communication with the Secretary 
o Access to / training on handling of classified information. 

■ Guidance on handling classified leaks, or inquiries from press 
Knowledge of the server 

o Frequency of emails to / from 

Guidance on sending material to the server 0 

Procedure for communicating classified information to the Secretary (if applicable) 

■ Did it vary when she was traveling, in NY, etc. 

o Concerns with the use of the server or other communication channels 
Discussion of specific email(s) 

o ICIG believed that classified information may be contained in email sent by Slaughter 
(subject "For S - for discussion on Afghanistan tomorrow') 
o Details surrounding the email chain in question. 

■ What was the source of the information cited 
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• How did you commwtkate sensitive / classfei information 
■ Typical of othe*' comimlnications made via tmaii? 

Any other thoughts / concerns regarding this matter. 

NDA request 
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As discussed, attached is the email chain. 


Please do not hesitate to contact me with any questions. 


Warmly, 
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February 3, 2016 


Special Agent 

FBI, Washington Field Office 


Dear Special Agent 


As discussed, below you will find the email chain we have been 
hesitate to contact me with any questions. 



Please do not 


Very warmly, 


/s/ 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-18-2016 BY J76J18T80 NSICG 


Ambassador Stephen Mull 
Executive Sec retary (2011) 
[ // Telephone 


^Office Manager -f 


b6 

b7C 


Introduction 


o 

o 

o 


Voluntary / Can stop at any time J 

NSLB Disclaimer re: Garrity / not interested in prior statements to DOS\/ 

FBI's interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. 

Brief overview of duties as the Executive Secretary 

o What were you duties as they related to the operation of the Secretary's private server, 

or ofti^rftgbbile comms platforms? . pU rfte-to I 

Wunhuniry. 


o What your duties as related to the Ops Center? p 

• Knowledge of the private server and email - 

o Was there an approval process for the use of private email / email servers? 


If so, what is the approval process for this arrangement? r/o+'dwiee- Of 

■ What steps were taken to review the risks / benefits of this arrangement? 

■ Who was involved in the review process? 

■ Was this consistent with DoS policy at that time? 

■ Did the server violate department policy as stipulated in the Foreign Affairs 
Manual? 

■ What is the current policy today? 

• When / why did it change? 

o Who had knowledge of the server from DOS at the onset? 

■ When did you become aware of the arrangement? 

o Did DOS have any role in setting up and / or maintaining the server? 

■ If so, who specifically was responsible for this? 7 

• DoS employee, or a contractor? 

o If contractor, what steps to ensure actions were consistent with 
IMS-POEMS procedures, protocols? 
o If contractor, what steps to ensure appropriate threat 
monitoring? 

o Knowledge of Brian Pagliano's role? Payment structure? 

• What steps were taken to ensure appropriate security protocols were in 
place (updates, patches, antivirus, intrusion monitoring)? 

• Who paid for the set up costs and maintenance costs? 

• Were the secretary's server related expenses reimbursed by State? 

o If paid for by State, what is the policy on paying for the 
maintenance of personal property? 

o What guidance was provided by DoS regarding the transmission / storage of sensitive 
and/or classified information on the server? 
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o What secure comms were available to the secretary at her home and when she was 
traveling? 

■ Phone 

• Fax 

■ Email (Classnet / JWICS) 

Discussion of emails 

o August 2011 email regarding state issued BB (connectivity issues following hurricane 

o - $Sj$»ember 2010 email regarding Bluetooth vulnerabilities (CLASSNET - SECRET) 

• Why was this sent to Cheryl? (i.e., was it requested, was it standard 't& sand 
such alerts, etc) 

■ Did they request the offered briefing / demo? 

■ Were the implied recommendations to disable Bluetooth implemented? 

• By whom? 

• Who maintained her blackberry w/ respect to security etc 

o Did you have direct contact with them? How often? 
o Did they request information about DoS security 
recommendations? How often? 
o July 2010 Email (use of mobile device in office) 

context on this? 
m '.-,‘hat device are they referring to (ipad)? 

■ What was the resolution - was she able to use it in her office? 

• Did she use other devices in her office? 

■ Who else was involved in these discussions / approvals 
Any other thoughts / concerns regarding this matter. 

NDA request 




IT security in Moscow 
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From: 

Sent: 

To: 

Subject: 


"Macmanus, Joseph E" <CLASSSTATE/CBPC ADMINISTRATIVE 
GROUP/RECIP!ENTS/MACMANUSJE> 

10/6/2009 6:07:49 PM +00:00 

"Mills, Cheryl D" <MillsCD@state.sgov.gov>; "Sullivan, Jacob J" 
<SullivanJJ@state.sgov.gov>; "Abedin, Huma" <AbedinH@state.sgov.gov> 
IT security in Moscow 


Our Md&fie Communications Team sent in an email on electronic surveillance and 
monitoring in Russia, which I’ve excerpted below. The gist of it is: what's yours is 
theirs. 



We will brief staff at the airport before departuf^and post the necessary warnings 
in the hotel. 


From: Mobile Communications Team, Moscow Advance 
Sent: Tuesday, October 06, 2009 10:40 AM 
Subject: IT security in Moscow 


b7E Per DOS 

Yesterday at the RS O's security briefing, the RSO stated that the IT threat level here 
in Moscow currentlyF I 


The following are recommendations regarding IT security in Moscow: 


b7E Per DOS 

Strong recommendation against any classified material or conversations in the 
hotel, including STE conversations and any printed materials, whe ther brought to 
the hotel by the party or delivered by courier. No matte r how well | ~| 

_The Se cretary's suite as w ell 

as the Senior Bureau, the Secretariat, and all bedrooms will be( 


file:///C:/User| 


AppData/Local/Temp/adtemp/ad_tmp_b44bd046-2067-43a8-b0f... 
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•« IT security in Moscow 


Page 2 of3 


b7E Per DOS 


Strong recommendation against the use of BlackBerries : when you bring your 
BlackBerry online in Moscow,! 


tv 


Strong recommendation agJdst computers connected to the Internet in the hotel. 


b7E Per DOS 


Authorized the use of FOBs in the hotel ONLY for use with government-owned 
laptops under 100% continuous positive control by a cleared American. If left 
unattended at any time, for example, while somebody goes downstairs for 
breakfast, they will be compromised. 


NOTE: a lost or stolen FOB here in Moscow is a major security threat. All m ust take 
great care not to loose their FOBs. _ b 7E 


DS Lead and DS Logistics indicated that they did not want computers and printers in 
their bedrooms per the IT requirements and would rather work in the Embassy. 

The laptops intended for them are being stored in the Embassy. 


Communications set-up in Moscow: 


Co mputers issued by MCT or supported by MCT fe.g., Abedin, Sullivan. Maemanu s) 


r—*-*-‘-* n ! , 1 - 1 - 

will| 


b?E Per DOS 

the Marines and DS will restrict access. Anyone in a bedroom outside of the 


must keep their laptops in their possession at all times 
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IT security in Moscow 


Page 3 of 3 


store them at the Embassy (for example in 



b7E Per DOS 


Computes we set up in S offices and bedrooms will be laptops owned by the 
Embassy and will remain in our custody while outside of the Embassy. The traveling 
party should be notified that we will have to use laptops instead of desktops at this 
stop. 





An 

bef 


b7E OOS 


government laptop used in th e hotel and returned to Washington will need to 

"1 b7E Per DOS 



file:///C:/Use 
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From: 


'Abedin, Huma" <SBUSTATE/SES/RECIPIENTS/ABEDINH> 


Sent: 8/30/2011 9:34:07 PM +00:00 

To: "Mull, Stephen D" <MullSD@state.gov> 

Subject: Re: S Communications 


Its pretty silly and she knows it. 

From: Mull, Stephen D 

Sent: Tuesday, August 30, 2011 05:18 PM 

To: Abedin, Huma 

Subject: RE: S Communications 


Thanks for reminding all of this very helpful context!!! © 


From: Abedin, Huma 

Sent: Tuesday, August 30, 2011 17:17 PM 
To: Mull, Stephen D; Mills, Cheryl D 
Cc: Kennedy, Patrick F; Hanley, Monica R 
Subject: Re: S Communications 


Steve - let's discuss the state blackberry, doesn't make a whole lot of sense. 

As for the equipment, the commo team was limited in some capacity because we did not have 
authorization from owners of residence to install equipment. We did it regardless. Additionally, as S 
knows, the team didn't have access to the property until a couple of hours before S arrived. 

Finally, as even the white house attested, this was a pretty wide spread problem, not just affecting us. 
So we should bear that in mind. 


From: Mull, Stephen D 

Sent: Tuesday, August 30, 2011 01:39 PM 

To: Mills, Cheryl D 

Cc: Abedin, Huma; Kennedy, Patrick F; Hanley, Monica R 
Subject: S Communications 
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Cheryl, 


Thanks again for alerting me to the communications issues the Secretary has been having. Here's a status report: 
•_ Secretary's not being able to have her calls transferred]" 

, [' ( ' » Vt , ' ' • 


—TTT'V 




technicians are onsite nowT 


b7E Per DOS 


X\-L 


I,, .• > ii 

. ^ r *,» • 1 h * w 

• On'ij^s asked our team to develop an enhanced package of capabilities and 

equipment with the Secretary to be as closely co-located as possible with her 

when she is p^|* | f^jn J rjiF^j|Ijsi,'*f||residences. The package will include things that anticipate the 

normally unexpected such as hurricanes, power outages, earthquakes, locusts, etc, such as generators, 
uninterrupted power supplies, supplementary satellite capabilities, including satellite phones for when local 
infrastructure fails (as it did in NY over the weekend). 


Separately, we are working to provide the Secretary per her request a Department issued Blackberry to replace 
her personal unit which is malfunctioning (possibly because of her personal email server is down). We will 
prepare two versions for her to use - one with an operating State Department email account (which would mask 
her identity, but which would also be subject to FOiA requests), and another which would just have phone and 
internet capability. We're working with Monica to hammer out the details of what will best meet the Secretary's 
needs. 


Please let me know if you need anything more for now, and I'll be in touch with the above longer term options 
soon. 


Thanks, 

Steve 


PR_RIM_MESSAGE_SUBMISSION_ID: 


PR RIM PAGER TX FLAG: 


true 


b7E Per DOS 


PR_RIM_INTERNET_MESSAGE_ID: 


PR RIM MSG FOLDER ID: 


-5 


PR_RIM_MSG_REF_ID: 


876690920 
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FW: FW: Bluetooth Vulnerabities 
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ALl^il^iNFORHATION CONTAINED 

From: "Mull. Stephen D” <CLASSSTATE/VCIISNPM/RECIPIENTS/MULLSD> UNCLASSIFIED 

Sent: 11/9/2010 4:32:28 PM >00:00 DATi? tJ^-23-2019 BY C66W46B11 NS ICG 

To: "Mills. Cheryl D" <MillsCD@state.sgov.gov> 


Subject: 


FW: FW: Bluetooth Vulnerabities 


HI Cheryl, 

Here's the summary of Biuetooth vulnerabilities I mentioned. If you'd still like a briefing/demo (which I think you'd find pretty 
interesting/diusturbing), iet me know and I'll be happy to set up. Not that I normally like to disturb my boss! 

Steve 


From: Bentel, John A 

Sent: Friday, November OS, 2010 4:23 PM 

To: Mull, Stephen D 

Cc: Lukens, Lewis A; Green, Milton V; Jacks, Yvette R 
Subject: Biuetooth Vulnerabities 


Steve: 

Listed below are vulnerabilities of Bluetooth on a Blackberry. Further down you will find more technical details should you wish to read more. 


At the recommendation of our IT counterparts In DS - I have reached out to DAS Gentry Smith requesting to meet to see if It Is possible to 
enable Bluetooth and adhere to a security posture. 

Please let me know If you h«^iiiiiSy'i|uestions or concerns. Will keep you posted. 

Thanks, 

John 


<S/W*^_ 

Can be exploited from a considerable distance away and be undetected. 

Attacker can take full control of the device. 

Attacker can take every email on the device. 

Attacker can set up an attack to move to any new device swapped out using the same SIM. 
Attacker can listen to any phone conversation. 

Attacker can turn the phone into a listening device. 

Able to use the phone to send SPAM emails looking as the user. 


(Si 


bl Per 
b7E DOS 


*1 f 

Expanded details fojrpw:?. 



Biggest concern to 



During pifek 

unau. _ 

exploit!*^! 
the Bfeefe&rry. 
The tjss&fiisa*. . 
network?, vTtftS- 


feual Las Vegas "hacker convention"), a computer security consultant discovered an 
ition networks - using the BlackBerry. The consultant developed a hacking program 
fip/iihe BiackBerry and a company's internal BES server. Because the data tunnel between 
gted, intrusion detection systems at the perimeter of the network wiii not detect the attack, 
companies are not equipped to detect someone trying to deliver an expioit from inside a 
view the BiackBerry as a plausible attack vehicle. 


file:///C:/Users | AppData/Local/Temp/adtemp/ad_tmp_dfac3c85-ddb6-48ba-bb3... 
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FW: FW: Bluetooth Vulnerabities 


Page 2 of 2 


The first exploit Is known as "BLUESNARFING". ALTHOUGH BLUETOOTH IS WIDELY CONSIDERED A SHORT RANGE NETWORK STANDARD, THE 
EFFECTIVE RANGE OF THIS ATTACK CAN BE EXTENDED WITH HIGH GAIN ANTENNAS UP TO A MILE. 


A GREATER THREAT INVOLVES WHAT IS REFERRED TO AS A 
THE DEVICE AN D THEBR3* £&L*jS. FULL CONSOLE CONTROL. 

> MAKE TOU^iiS^-:";^ 

> CHANGE ^irfe?iSis2®?»NEBOOK ENTRIES TO A RECORD AND FORWARD NUMBER TO MONITOR CONVERSATIONS 

> HACK/SEND SPAM EMAILS FROM A TARGETS PHONE 

> HAVING SOMEONE'S PHONEBOOK WOULD ALLOW AN ATTACKER TO NAMEDROP AND SOCIALLY ENGINEER THE TARGET TO DISCLOSE 

SENSITIVE INFORMATION 

> TURN A PHONE INTO AN OPEN MICROPHONE BY CONFIGURING IT TO AUTOANSWER AN INCOMING CALL WITHOUT RINGING 

> LISTEN TO THE TARGETS VOICEMAIL 

READ OR SEND TEXT MESSAGES TO OR FROM THE TARGET, RESPECTIVELY. 


"BLUEBUG" EXPLOIT, WHERE THE ATTACKER TAKES REMOTE SERIAL ACCESS TO 
THJ5.AU.aWS THE ATTACKER TO DO THE FOLLOWING: 



The "BACKDOOR" attack creates a secret paired (authenticated) relationship between a target device and a rogue device, allowing trusted 
connectivity and compromising the target's local data and services. Some Bluetooth-equipped cell phones, for instance, don't erase their lists of 
paired devices when users' Subscriber Identity Module (SIM) cards are swapped, enabling this type of attack to be moved from one device to 
another. 


The ’BLUEJACKING" technique involves abusing the bluetooth "pairing" protocol, the system by which bluetooth devices authenticate each other. 
The technique uses the first part of the process that allows the exchange to take place, and Is therefore open to further abuse if the handshake 
completes and the "bluejacker" successfully pairs with the targeted device. If such a pairing occurs, then ail data on the target device becomes 
available to the Initiator. This Includes every mall stored on the device. 


"Triniliuu. 

This email is UNCLASSIFIED. 


Message Headers: 



Classification: UNCLASSIFIED 

SensItIvltyCode: - Oi n j i li ie 

AttachmentaClassification: 

SMAR TCIass ideation Data 


file :///C:/Usen 


kppData/Local/Temp/adtemp/ad_tmp_dfac3c85-ddh6~4fiba-bb3... 
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From: 

Sent: 

To: 

CC: 

Subject: 


"Mull, Stephen D" <SBUSTATE/VCIISNPM AG/RECIPIENTS/MULLSD> 

7/7/2010 12:37:35 PM -*-00:00 _ 

| b6 Per 

"Abedin, Huma" <AbedinH@state.gov> b7c DOS 

RE: HRC 


See you then! 

.O riginal Message- 

From ] | 

Sent: Wednesday, July 07, 2010 08:37 AM 
To: Mull, Stephen D 

Cc: Abedin, Huma b6 Per 

Subject: Re: HRC b7c dos 

Great, I’ll swing by at 12:30 


— Original Message — 

From: Mull, Stephen D 

T ° 1 ~1 

Cc: Abedin, Huma 

Sent: Wed Jul 07 08:32:22 2010 

Subject: RE: HRC 

I am; either time works 


.O riginal Message- 

From ] I 

Sent: Wednesday, July 07, 2010 08:06 AM 

To: Mull, Stephen D 

Cc: Abedin, Huma 

Subject: Re: HRC 




pou by chance free either at 12:30, or 2pm? 


► 0> hoS$S£5M3>- 

<S5> 

— Message 

<ss> j>,g 

■ ^^^pOTBtfrftephen D 

Huma 


*00 



ul 01 11:33:11 2010 
: HRC 


Will do 


b6 Per 
b7C DOS 


b6 Per 
b7C DOS 


— Original Message — 
Fr om: Mull, Stephen D 
To: | | 

Cc: Abedin, Huma 

Sent: Thu Jul 01 11:29:08 2010 


HRC-1375 










Subject: RE: HRC 


Surel 

JustT 


that would be great, though we should probably talk first in person before involving others. 


Just let me know when’s convenient for you when you get back. 


— Original Message— 

Frorr l I 

Sent: Thursday, July 01,2010 09:58 AM 

To: Mull, Stephen D 

Cc: Abedin, Huma 

Subject: HRC 


Hey Steve, 


Hope you're settling in to the nicest office at HST. When we're back from Europe, I'm hoping to sit with 
you and not sure who else is relevant HRC wants to use an electronic device we bought for her in her 
office, wants me to figure out if it’s doable or what we have to do to make it doable. I don’t know who 
replaced Julia Hill, but I assume they should sit in too, maybe Cindy Almodovar who I think is the best 
IRM person in the department. 


Message Headers: 


From: "Mull, Stephen D" <MullSD@state.gov> 
To: "Reines, Philippe I" <reinesp@state.gov> 
Cc: "Abedin, Huma" <AbedinH@state.gov> 


b6 Per 
b7C DOS 


b6 Per 
b7C DOS 


b6 Per 
b7E DOS 
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PR_RIM_INTERNET_MESS 

AGEJD: 

PR_RIM_MSG_STATUS: 

PR_RIM_MSG_ON_DEVICE 

_3_6: 

PR_RIM_MSG_REF_ID: 

PR_RIM_MSG_FOLDER_ID: 




tate.sbu> 
true 


-1139874124 

-6 


b6 Per 
b7E DOS 


PR_RIM_MESSAGE_SUBMI 

SSIONJD: 

PR_RIM_DELETED_BY_DE 

VICE: 


true 


b7E Per DOS 


PR_RIM_PAGER_TX_FLAG: true 
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File Number I 

Field Office Acquiring Evidence . 
Serial # of Originating Document 


Date R 


From 





^ributor/liucrvicwcc) 


(Address) 





To Be Returned D Yes No 

Receipt Given Q Yes [pp No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes &>No 

Federal Taxpayer Information (FTI) 

□ Yes 




Reference: 


: Of 


Description: ^ Original notes re interview of 
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Introduction 

o Voluntary / Can stop at any time 

NSLB Disclaimer re: Garrity / not interested in prior statements to DOS 
FBI's interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. 

Witness identifiers, 3 rtl party witnesses and affect on confidentiality 


o 

o 


Brief overview of duties as|_ 

o Clearance, training, frequency of handling classified information 
Knowledge of the private server and email 

o When did you become aware that the Secretary was using a private email / server? 
o Was this consistent with DoS policy? 

o Did you ever witness the email content that you felt was particularly sensitive even if it 
wasn't marked as classified? 

Discussion of video 

o | ~\>013 speech to the American Foreign Service Association 
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b6 

b7C 


Video quote: 


b6 

b7C 


• Can you provide some context to this statement? 


HRC-1380 
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What did Imean bvl~ 


o Was sensitive or classified irsfemsation conducted on the system? 

■ In this instance or ever? 

o Was | [ classified? - No 

■ How would this be crafted pre-BB? Why? 

When does US strategy / policy or other diplomatic negotiations become classified 
in your mind? 


• Any other thoughts / concerns regJsM^g this matter. 

• NDA request 
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File Number _ 
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Field Office Acquiring Evidence 


Serial # of Originaling Document 


55 


Date Received 
From 


IO . Z-OlCo 


/Interviewee) 
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b7C 


(Address) 


(City and State) 


By 


To Be Returned □ Yes ^ No 

Receipt Given O Yes No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes /S' No 

Federal Taxpayer Information (FTI) 

□ Yes /S No 


(NA. l O 


b6 

b7C 


Reference: 


(Communication Enclosing Material) 


Description: 


Original notes re interview of 
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interview Qutilne 


sionai uacKgrouna- ---- 

- current) 


at DoD 




Natio nal Security Council 

o 
o 
o 


Question Outline 

• Introduction 

o FBI’s interest in the matter 
o NSLB disclaimer re: prior statements 
o Can consult counsel if necessary 

• What is your current position? 

• Brief description of role at NSC as relative to Department of State? 

o How often did you coordinate with DoS? 

■ For what types of matters? 



(/ 




& 






-,V 


/ 






- o 


c/ 










A 






A 




Who were you primary contacts at DoS? 

What was the nature of the communications? 

How often did you send / receive documents to DoS? 

• Examples of? 

o Classified, unclassified? 
o How were the documents transferred? 

Email regarding PC meeting 

o October 4, 2009 email chain witH{ Regardin g content for a Re stricted PC mee ting m 

jecommendations -£ 


October 5 th , 2009 regarding Af-Pak. 


3 oT1 


b6 

b7C 


Do you recall the Restricted Principals Committee meeting? Can you provide 
general context on who / what was involved? 

• Do you recall if the final product for the PC meeting was classified? 


o At what level(s)? 

EMAIL 1- ^ 

• What is being couriered and to whom? ^ 

o Is this typical? 

• What is at the Secret level? 

• What is the DNI stuff that you are referring to? What was it classified? 

o Where did you get it from? 
o How can we track it down? 

EMAIL 2a, 2b and 3- 

• What was the 'DNI piece' specifically? 

• Who was the originating agency? 

• What was the classification of the piece? 

• Where was it couriered to, DOS? How would this have been done? 
Who would have sent it / who would have it been sent to? 

EMAIL 4- 


HRC-1387 



• What is the standard procedure for distro of the package. Who does it 
go to? 

■ EMAIL 5- 

• What is washfax? foV 1 " 

■ EMAIL 6- 

• What does Tab 2 refer to specifically? 

o Is it the same as the 'Df'gJpKce' referenced above? 
o What was the classificationfc’vel of this doc, TS? 

■ DNI piece appears to be S, as you attempted to send it 
via SIPR 

o Does NSC / EOP archive content from each PC meeting? 

• What department / who is the POC for this? 




■ EMAIL?- 

n a * t. £ f {£ ' 

• Were therapy 

• What wobft? after e PC meeting with regards to specific 

policy / strdjtegV’? ’ 1 / , ; 

• How wouW thesrrajj^jog be disseminated to relevant 

agencies? « : •»* V,* i 

■ EMAIL 8 & 8a - (hezder./i^«J*fr s ehii»iI i- on way forward in Afghanistan, 

Plan for PC tomoHr<xi*, twiljfs Cifrttorr-and Petraeus) 

• What was^re^^tEjstjotr.tbii 

• Do you reca!i what su^partkig iJifiakifation was provided by DoS 

o Classification of it? 

0 5s it maintained by NSC. 

• Did you ever have concern about the transmission of sensitive / classified info on unclass, or 
non-government? 

• Any other relevant information? 



4 




k 

91 / 



• NDA 


HRC-1388 




ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-21-2016 BY J76J18T80 NSICG 



Question Outline 

• Introduction 

y£> FBI's interest in the matter 
/6 NSLB disclaimer re: prior statements 
“o Can consult counsel if necessary 

• What is your current position? 

• Brief description of role at NSC as relative to Department of State? 
o How often did you coordinate with DoS? 

■ For whst types of matters? 

■ Who were you primary contacts at DoS? 

■ What was the nature of the communications? 

■ How often did you send / receive documents to DoS? 

• Examples of? 
o Classified, unclassified? 
o How were the documents transferred? 

• Email regarding PC meeting 

o October 4, 2009 email chain witl \ \regardin g content far a Re stricted PC mee ting an 
October 5 th , 2009 regarding Af-Pak \ [ecommenda tians - | 

■ Do you recall the Restricted Principals Committee meeting? Can you provide 
general context on who / what was involved? 

• Do you recall if the final product for the PC meeting was classified? 
o At what level(s)? 

WAwi -h> EMAIL1 ~ Dtrm \mkzo rtt. of fpc&tho M-fai.' fry 

i. J—— --- • What is being couriered and to whom? / jj J _xt„ 1 

fv-Y-<Sciu<nh* IT) ° ls this typical? — ‘V 

^ ' \y • what is at the^ecret level? 

(3^ CtTW-ntf'i'" • Whatisjjl^DNI^uff that you are referring to? What was it classified? 

X- —6 WneTeaid you get it from? 

Dtrn| ftCiM. ty(0,f\b 0 How can we track it down? 

■ EMAIL 2a, 2b and 3- 

• What was the'DNI piece'specifically? 

CM tttoM • Who was the originating agency? 

-fthkS • What was the classification of the piece? 

• Where was it couriered to, DOS? How would this have been done? 
Who would have sent it / who would have it been sent to? 

■ EMAIL 4- 


-fry Txxjrss . 


CM tttoA 


In 4 pfTWidcJ p before . 

pa Qtr DDD papi'"_ + Sfaf W txh-e^L -ft HRC-1389 

^ W* ch 






CMjlo n 

(j)^^ J'eneU nettle# 

4 4 U+ . 

pA-ce 6jvn«j m 3~^ d.o^sr y<-{ 

• What is the standard procedure for distro of the package. Who does it eJ^ot 
go to? 

■ EMAIL5 “ r ) f jura uMPTftr 

• What is washfax?/ » 0 

■ EMAIL 6- -c/W v _——7T- 

• What does Tab 2 refer to specifically? lJ TrM, 

^ / o Is it the same as the'DNI piece'referenced above? c2daA\J hi 

Mjr i-° What was the classification level of this doc, TS? -fo 

^ * DNI P iece appears to be S, as you attempted to send it 1 ' 

^Vx^X viaSIPR 

' o Does NSC / EOP archive content from each PC meeting? 

■ What department / who is the POC for this? 

■ EMAIL 7- 

• Were there any follow up items? 

• What would typically happen after a PC meeting with regards to specific 
policy / strategy? 

• How would decisions from the meeting be disseminated to relevant 
agencies? 

■ EMAIL 8 & 8a - (header / footer email - tp on way forward in Afghanistan, 

Plan for PC tomorrow, meeting with Clinton and Petraeus) 

> • What was the context of this email? 

• Do you recall what supporting information was provided by DoS 
o Classification of it? 
o Is it maintained by NSC. 

• Did you ever have concern about the transmission of sensitive / classified info on unclass, or 
non-government? -—^ Not XY>lX \ CA^n ("C CmAJ. „ 

• Any other relevant information? 

• NDA 

tVnt- Vccax\ tmtu licuj- di rtUr\^ ^ I 

j $ Qpuluiurnj / UcorcA ^1 V^l 

Ortfl) li-r tycc ^Oc U<Wh 

% ewr|*nr*<J .iL'w ** 

bmtfo< W^' m-fi) ^ htJidtfnl 

W o.i\a -jutfUj - |dn»^ 

' If +nj -h ^rvtt 



Q) 


^ i 

/5) • r 

UJreArAraj^ 

J 

S'sC- o{f] U<jU 

heo of /n-(^ . 

( rvU' +t tM^Vj &lf£rd& 

rvunuu^sA 

f - dt y HRC-1390 





t>c - iot r^s is 

pc H*h- 11 

pk-i :£\d<f\'\r ~ A’&x-c ■fafic "fr rv0>r ~^ . 



- RE: How's it looking? 


Page 1 of 2 


From: "Spence. Matthew b6 Per NSC 

Sent: 10/4/2009 11:06:59 PM *00:00 

To: "Sullivan. Jacob J" <SBUSTATE/SES/RECIPIENTS/SULLIVANJJ> 

Subject: RE: How's it looking? 


Thinks man, lt'1 blood out of a atone with the Holbrooke team. 


I'm going through the DNI atuff now. It'a pretty decent, with a few exceptions. 


From: Sullivan, Jacob J [mailto:SulilvanJJ@state.gov) 
Sent: Sunday, October 04, 2009 6:34 PM 
To: Spence, Matthew J. 

Subject: Re: How's it looking? 


V94 


From: Spence, Matthew J. | | b6 Per NSC 

To: Sullivan, Jacob J 
Sert&4ftS*)iS04 18:29:S7 2009 
Sutg««* ; S'lKvfiow's it looking? 

( ' Lf' 

d0H8^|n%giar option la for us to courier this stuff out tonight, and then email out your paper very late tonight, since It’s at the Secret level, right? 


From: Sullivan, Jacob J [mailto:SulllvanJJ@state.gov) 
Sent: Sunday, October 04, 2009 6:27 PM 
To: Spence, Matthew J. 

Subject: Re: Hows it looking? 


Moving oi tost ot potable 


-L_Ll_E ’1 1-1 - r ,-j P . j .jj.l 


From: Spence, Matthew J. 
To: Sullivan. Jacob J ' 

Sent: Sun Oct 04 18:20:27 

[rnrn-; 

M 

b6 Per NSC 

m ' 


Man Spence 

National Security Council 


Message Hoaders: 


mi -.-• 

Ml n + • 
t ',’ ■ 

’■ ( 

Sun, 
Received: 

Sun. 4 

Received: from| 
Sun, 4 Ot 
Received: from|_ 
Sun, 4 OC 
Received: from 



b6 Per 
b7E DOS 




Jstate.sbu with i 
Jstate.sbu w 


Sun, 4 Oct 2009 19:07:15 -tftUU 
Received: from esoeooOl eop.oo v (mailhub-eoD3.eoo.oov (19 8.137.241.4111 
by stlmson2.statc.gov with l I 

for <SullivanJJ@state.gov>; Sun, 4 Oct 2009 18:S2:33 -0400 
Received: from esgcop01.eop.gov ((198.137.241.41)) 
by Stimson-l.state.gov 

for <SuliivanJJ@state.gov>; Sun, 04 Oct 2009 23:. 

Received: from es 2 £O£ 02 ^eop.gov by esgeopOl eop govj^^.: 

X-SENDER-1P: 1 i 

X-SENDER-REPUTATION; None 

content-class: urn:content-dasses:message 
MIME-Version: 1.0 
Content-Type: muitipart/alternative; 


Jstate.sbu with Microsoft[ 


b6 Per 
b7E DOS 


lfor <SuNivanJJ@state.gov>; Sun, 4 Oc 


L 




X-MimeOLE: PriJJSgsft^lj Microsoft Exchange V6.0.6619.12 
Subject: RE: HQ@*£|gs|tiJing? 


□ 


HRC-1392 
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- RE: How's it looking? 


Page 2 of 2 


Date: Sun, 4 Oct 2009 19:06:59 -0400 

. Message IC: <391D44DBDlE2C94EBE988E74EE0C2216013B61C0@SMEOP18EVS.eopdseop.gov> 
X>«5 lai Attach: 

X:d3‘'S;»‘Cn;relato. 

T>irtf3d-'Tijiic ; Sow's it lookina? 


L 


1 PSs*$S : Matthew J I | - 

ift>: Jacob I" <SullivanJJ@state.gov> 

X Grti*a (A.-riva iTimc: 04 Oct 2009 23:06:59.0921 (UTC1 F1LET1ME =T 
Return-Path: prvs=52 178f90(H [ L 

X-TM-AS-Produ ct-VerJ T 

X-TM-AS-Result j | 

X-TM-AS-User-Approved-Sender: No 
X-TM-AS-User-Blocked-Scnder: No 


Jstate.sbu> 


[ 


Content-Type. 

charsetf_ 

Content-Transfer-Encoding: base64 


Content-Typ 

charset 


r ■ 

Content-Transier-tncod'ng: basc64 


b6 Per 
b7E DOS 


b6 Per NSC 


b6 Per 
b7E DOS 


PR_RIMJNTERNET_MESSAGE_ID: 

PR_RIM_PAGER_TX_FLAG: 

PR_RIM_MSG_FOLDERJD: 

PR_RIm’dELETED_BY_"oEVICE: 

PR_RIM_MSG_REF_ID: 

PR_RIM~MSG~STATUS: 

PR_RIM_MSG_ON_DEVICE_3_6: 


1 

<89IO44DBO1E2C94E8E988E74E60C22160l3B6tC0@SMEOP18EVS.eopds.eop.gov> 

irue 

-3 

true 

-2021940588 

1 

true 


HRC-1393 
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Just sent you the DNI piece on SIPR 


Page 1 of 1 


b6 Per NSC 


From: "Spence. Mallhew j | \ 

Sent: 10/5/2009 12:16:30 AM *00:00 

To: "Sullivan, Jacob J" <SBUSTATE/SES/RECIPIENTS/SUILIVANJJ> 

Subject; Just sent you the ONI piece on SIPR 


Matt Spcncc 

National Security Council 
(202)456-9481 


Message Hoadcrs: 



b6 Per 
b7E DOS 


- r- 

gecsivocn . . _ 

- Sun-4 Oct 2009 20:46:37 - 0405 
Received: from stimson2.state.gov ~ 

Sun, 4 Oct 2009 20:46:37 -04CC 
Received: from esqcopOl.eop go v (mailhub eoo3.coo.oov 
by stimson2.state.gov with^ 


tate.sbu w 


Jstate.sbu with Microsoft □ 


8.137.241.411) 

-0400 


for <SullivanJJ@state.gov>; bun. 4 6ci 2&0? 2o.32.04 
Received: from esgeop0l.eop.gov ([198.137.241.41]) 
by Stimson-l.state.gov 

for <SuilivanJJ@state.gov>; Mon, 05 Oct 2009 00: 53:46 *noon 
Received: fro m esaeoo02.e on.oov by esgeopOl.eop.gov j 

AT10N: None 
content-class: urn:content-classes: message 
MIME-Version: 1.0 

comen[-Ty BS ; nuUiMU/aHefnative-, 


X-SENOER-IP: 

X-SENDER-RE 


]for <SullivanJJ@state.gov>; Sun, 4 0( 


nt enl-T 


X-MimeOLS: Produced By Microsoft Exchange l f 

Subject: Just sent you the ONI piece on SIPR 
Date: Sun, 4 Oct 2009 20:46:30 -0400 

Message-ID: <89lO44DBDlE2C94EBE988E74EE0C22l60l3B61CF@SM6DP18EVS.eopds.eop.qov> 

X-MS-Has-Attach: 

X-MS-TNEF-CorrelatOr: 

Thread-Topic. Just sen! ypp (hg P NI BlgK gn SIPR , 

Thread-Index ! I 

ce, f — ■ ■ 


From: "Spence, Matthew j.’_ 

To: "Sullivan, Jacob J" < Sullivanjj@state.gov > 
X-Or.ginalArrlvalTime: 05 Oct 200? flfl 3Q . Qg53 [ UTU aLglt 

Return-Path: 0rvs-52 2d2l f 1 
X-TM-AS-PrOdu ct-Veri 

X-TM-AS-Result l I - 1 

X-TM-AS-USOr-Approved-Scnder: No 
X-TM-AS-User-Blocked-Sender: No 


J 


b6 Per 
b7E DOS 


b6 Per NSC 


tilontent-'iype:texj^£lajm 

charset ^ I 

Content-Transfer-Encoding: quoted-printable 


Content-Type: lext/html; 

charset** ) | 

Content-Trans'er-Encodlng: 


ng: quoted-printable 


PR_RIM_INTERNETJVIESSAGEJD: 
PR_RIM_PAGER_TX_FLAG: 
PR_RIM_M$G_FOLDER_ID: 
PR_RIM_OELETEO_BY_ DEVICE: 

P R_RI M_M SG.R EF _ID: 
pr_rim~msg!status: 

PR_RIM_MSGlON_DEVICE_3_6: 


<89lO44OBDiE2C94EBE988E74EE0C2216013B6iCF@SMEOPi8EVS.eopds eop.gov> 

true 

-3 

Hue 

-1375815399 

1 

Iroo 


HRC-1394 
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State paper 


Page 1 of I 


From: 

Sent: 

To: 

Subject: 


"Spence. Matthew J. 1 I 

10/5/200911:35:36AM +00:00 . b6 Per NSC 

"Sullivan. Jacob J" <S8USTATE/SES/R£CIPiENTS/SULUVANJJ> 

Slate paper 


Hey man - 


Sorry to sound like a broken record, but know when you ail couid shoot that paper over? 

I also saw lhal the ONI thing I sent on SIPR didn’t go through for some reason. But the package was couriered over, so you all should have it by now. 
Mall Spcncc 

National Security Council 
(202)456-9481 


Message Headers: 


PR_RIM_INTERNET_MESSAGE_ID: 

PR_RIM_PAGER_TX_FLAG: 

PR_RIM_MSG_FOLO£RJO: 

PR_RIM_DELETED_BY_DEVICE: 

PR_RIM_MSG_REF_ID: _ 

PR_RIM_MSG_STATUS: 

PR_RIM_MSG_ON_DEVICE_3_6: 


Microsoft Mail I nternet Headers Version 
Received: from l 

Mon. 5 Oct 2009 07:35:44 -0 


Received: fro [ 


Mon, 5 Oct. 


rs version 2J1 
3tate.sbu| 
on -nooo I— 


state.sbu 


os 

Received: froml 

M,n.s 0 ^ns a»? , » 44. Q4 Q Q 

Received: from[_ 


E 

Estate, sbi£ 
jstate.sbu Q 


>c 




J'dte sOu with Microsoft [ 

"^state.sbu with Microsofl 




H“yC 

D b C 


Jstate.sbu with I 


b6 Per 
b7E DOS 


Mon, 5 Oct 2009 07:35:00 - OoOQ 
Received: from stimson3.state.gov | 

Mon, 5 Oct 2009 07:35:03 -0W 
Received: from esgeopOl.eop.gov t ma.ih yt - t g a j.|; BB . MY [jQB 137.2Q1.Q1I) 
by stimson3.state.gov wlth | | 

for <SullivanJJ@state.gov>" Mon, 5 Oct 2009 07:29:08 -0000 
Received: from esgcopOl.eop.gov ((l98.137.2Qi.oi)) 
by Stimson-2.state.gov 

for <SullivanJJ@state.gov>; Mon. 05 Oct 2009 11 :05:18 + 0000 
Received, fro m csgeop02.e oo.iiov by esgeopOl .eop.aovl 

X-SENOER-1 P: l I - 

X-SENDER-REPUTATION: None 
cpntent-class: urn:content-classcs.messagc 
MIME-vcrslon: 1.0 

Contgn^-Tygg, mulUBflfl/flllBinflllVC;-- 


stale.sbu w 


Jstate.sbu with Microsofl 


□ 


jfor <SulllvanJj@5tatc.gov>; Mon, 5 Ot 


b6 Per 
b7E DOS 


Iljtnt-T 


X-MimeOLE: Produced By Microsoft Exchangc l f 

Subject: State paper 

Date: Mon, 5 Oct 2009 07:35:36 -0000 

Mcssagc-IO: <891DQ4DBOlE2C9QEBE988E7QCE0C2216013B61D8@SMEOPlBEVS.eopds.eop.qov> 
X-MS-Has-Attach: * 

X-MS-TNEF-Corrclator: 

Thread-Topic: -Sl/ilr nanff-, 

Thread-|ndex: | I_ . 

From: "Spence, t-tattne 


To: ' Sullivan. Jacob J" <Sunivanjj@state.gov> p 

X-Original Arrival Time: 05 Oct 2009 11:35:36.0970 (UTC) FILETIME *1 

Return-Path: prvs=52 2d2UI5< ----1 L 

X-TM-AS-ProduCt-Ve rJ 
X-TM-AS-Result: No- I 
X-TM-AS-Uscr-Approved-Scnder: No 
X-TM-AS-User-Biocked-Sender: No 


T 


^E = 


r 


b6 Per NSC 


b6 Per 
b7E DOS 


Content-1 ype: 

Charset4 

Content-TransfccriKripirS®): quoted-printable 


Content-Type : text/html : 
charset 4 ~1 

Content-Transfer-Encoding: quoted-printable 


1 

<891O400BD1E2C9OEBE988E70EE0C22l60l3B61D8@SMEOP18EvS.eopds eop.gov> 

truo 

-3 

true 

-1680938066 

1 

true 


HRC-1395 
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K±,: How's it looking? 


Page 1 of2 


From: 

Sent: 

To: 

Subject: 


"Spence. Matthew J. I” j 

10/4/20091 t:S3:27 PM *00:00 

"Sullivan, Jacob J" <SBUSTATE/SES/RECIPIENTS/SULUVANJJ> 
RE: How’s it looking? 


b6 Per NSC 


Golds, 


I'm flanns send this out now, but you'd help your cause a lot with Tom If you could have something that he can read when he walks In tomorrow mornino (which I 

wwifi f§§a first)' 


ONI m. 


•v;s-V <■;>?’ 


actually pretty lame and doesn’t help. But It's secret, so I’ll send it to you on SIPR. 


From: Sullivan, Jacob J [mailto:SuliivanJJ@statc.gov) 
Sent: Sunday, October 04, 2009 7:37 PM 
To: Spence, Matthew J. 

Subject: RE: How’s It looking? 


Thia it tough, but part of It Is S engagement. She wants to see final and edit before it goes. 


From: Spence, Matthew J. [malltof 1 

Sent: Sunday. October 04. 2009 7T77TW- 

To: Sullivan, Jacob J 
Subject: RE: How’s it looking? 


Thanks man, It's blood out of a atone with the Holbrooke team 


I'm going through tho ONI stuff now. Jt'o pretty decent, with a few exceptions. 


b6 Per NSC 


From: Sullivan, Jacob J [mailto:SulllvanJJ@state.gov) 
Sent: Sunday, October 04, 2009 6:34 PM 
To: Spence, Matthew J. 

Subject: Re: How’s It looking? 


V«§ 


From: Spence, Matthew J.l 
To: Sullivan, Jacob J 1 
Sent: Sun Oct 04 18:29:57 2009 
Subject: RE: How’s it looking? 

Gotchn, Anothor option Is for us to courier this stuff out 


tonight, and then email out your paper very late tonight, since It’s | ew# |_ right? 

i&Mi; 


b6 Per NSC 


From: Sullivan, Jacob J (mailto:SullivanJJ@state.gov) 
Sent- Sunday, October 04, 2009 6:27 PM 
To: Spence, Matthew J. 

Subject: Re: How’s il looking? 


Moving Bi IS9189 possible. 


From: Spence, Matthew jl 
To: Sullivan, Jacob J ' 

Sent: Sun Oct 04 18:20:27 2009 
Subject: How’s it looking? 


b6 Per NSC 


Milt Spence 


HRC-1396 
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: How's it looking? 


Page 1 of 2 


From: "Spence. Matthew J T ~l b6 Per NSC 

Sent: 1Q/4f2009 11:06:30 PM *00:00 

To: "Jones. Paul W' <SBUSTATEJMANILA AG/RECIPIENTS'JON£SPW2>; "Sullivan JacoD J" <SBUSTATE/SES/RECIPiFNTS/SLII I n/AN.l.l> 

CC: 'Tien, JohnK [ K ebson. EricM | | 

Subject: RE: How’s it looking? 


The 'Oiks hero linvo asked you to send It here, and dlstro with the package. It'll come on SIPR? Can you send a draft here, which we won't dlstro 

Beyond the few folks working on It here? - 


Looping In our folks handing this. 


SKI 


From: Jones, Paul W [mailto:JonesPW2@state.gov] 
Sent: Sunday, October 01, 2009 6:45 PM 
To: Sullivan, Jacob J; Spence, Matthew J. 

Subject RE: How's It looking? 


It <5 net ready for dlstro -still e number of items. 


now for S, if needed. 



From: Sullivan, Jacob J 

Sent: Sunday, October 04, 2009 6:36 PM 

To) I Jones, Paul W 

Su&jMt: He: How'4 il looking’- 1 


I think we need to email late tonignt. 


Just let me know the address(es). 


b6 Per NSC 


Adding Paul. Poul whore our ETA? 


I J P* * 


From: Spence, Matthew J,{ 1 

To: Sullivan, Jacob J 1 1 : ■ . 

Sent: Sun Oct 01 18:29:5? '2009 
Subject: RE: How's It looking' 

$ ~ ; . ~L j J 4 B ** *1_ ^ 

Gotcha. Anothor option it for ut » cotfflfit btl stuff out tonight, and then email out your paper very late tonight, since It's at the Secret level, right? 


From: Sullivan, Jacob J [maHW:«2E.«:0.H$stHB.*?tj 
Sent: Sunday, October 01, 2COO 6:2? I’M 
To: Spence, Matthew J. 

Subject: Re: How's It looking'' 


Moving 89 Iasi os passible. 


From: Spence, Matthew J. <T 

To: Sullivan, Jacob J 1 1 

Sent: Sun Oct 01 18:20:27 2009 
Subject: How’s it looking’ 

b6 Per NSC 


Matt Spence 

National Security Council 


• b6 Per 

b7E DOS 

Message Headers: Microsoft Mail I nternet Headers Version 2.0 

Received: fro m l I state.sbu l I ttvT 

Sun, 1 O ct 2C09 19 36 37 -C-CC |-- 

Received: from! Istate.sbul 

Sun, 1 Oct MM 19:06:37 -OlOfl 1 1 

Received: iroo j I states Du I 

Sun, 4 Oct 2009 19:06:37 -0100 1 - 


[ state.sbu with Microsoft f I 

1- 1 I state.sbu with Microsof CD 

> 1 1 state.sbu with Micrc 


HRC-1397 
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Checking in 


Page 1 of 1 


From: "Spence. Mallhew J | I 

Sent: 10/5/2009 9:44:10 PM *00.-30 

To: "Sullivan. Jacob J" <S3USTAT£/SES/REC'PIENTS/SULLIVANJJ> 

Subject: Checking in 


b6 Per NSC 


Hey man - Let me sort out the follow-ups from this mtg. then give you a call to check in on all of this... 


Man Spence 

National Security Council 


Message Headers: 


PR_RIMJNTERNET_MES$AGE ID: 

PR_RIM_PAGER_TX_FLAG: 

PR_RIM_MSG_FOLDERJD: 

PR_RIM_DELETED_BY_DEViCE: 

PR_RIM_MSG_REF_ID: 

PR_RImImSgIsTATUS: 

PR_RIM_MSG_0NJ)EV1CE_3_6: 


Microsoft Mall lnternet_Head£rs Version 2, 
Received: from I | state ehif* 

Mon, 5 On ?QQ9 i? 44 ?fl -IWflfl 
Received: from I 

Mon, 5 oittfM 17 ; 4 Ua-faaa 

Received: frpm| 


]state sbu£ 
Jstate.sbuQ 


>[ 


Istate.sbu with Microsoft! 


]by[ 


b6 Per 
^b7E DOS 


state.sbu with Microsoft 


=V 


Istate.sbu w 




Stetfi Itei with Microsoll f I 


Mon, S Oct 2009 17:44:27 - 0400 
Received: from stimsonj.State.gov | 

Mon, 5 Oct 2009 17:44:27 -OW 
Received: from es 9 eopOl.eop. 90 v tmailhub-eop3.eop.e 3v ’.19a.137.241.4iiy 
by stimson 3 .state.gov wlt H I 

for <Sutlivan)j@state.gov>; Mon, 5 Oct 2009 17:28:3/'-0400 
Received: from esgeop01.eop.gov ((198.137.241.41]) 
by Stimson-2.state.gov 

for <SullivanJj@state.gov>; Mon, 05 Oct 2009 21,$4:0? *0000 
5^?«S2o f, o'r SaS2E22i S >P ' 90V by •SOWN-W.gov to nK-U’fisttOWVW for sSiillivniOies-ate gov>; Mon. 5 Od 

A‘dCNULK‘lr .1 I 

k-REPi , “- u! "- ' 


X-SENDER-REPUTAT10N: None 
content-class: urn:content-dasses:message 
MIME-Version;?*#^- ’ 

Conte 


b6 Per 
b7E DOS 


R ent-Type: .ftNi&& «altetnativf: 

limam C 0 .£JC£f"'. . u.:. - -t. r 


X-MimeOLE: Microsoft Exchange d ~ ~ ' 

Subject; Cjlfsliihg in '" 

Date’ «t>syS Oct 2009 17:44:10 -0400 

Mesi:*v*-l»J; e:891O44OBOlE2C94EBE988E74EE0C2216013B61EE@SMEOP18EVS.eopds.eop govs 
X-M<?vKy*vt!cach: * 

X-MS-TTfEi* -Correlator: 

Thread-Topic: Criming ,p- 

Thread-Index: ! I 

From: "Spence. Matthew J. [ • 

ull 


To: "Sullivan, Jacob J" <SullivanJJ@state.gov> .- 

X-OriglnalArrlvalTIme. 05 Oct 2009 21:44:1Q. 0 4 M ( UTC1 r| L£T1M FJ 
Return-Path: prvs«S2 2dZl f l 5 I L- 

, r 

4 i 


prvs»52 
X-TM-AS-Prpdu ct-Ver: 
X-TM-AS-Result l 
X-TM-AS-User-Approved-Sender. No 
X-TM-AS-User-Blocked-Sender: No 


b6 Per 
b7E DOS 


b6 Per NSC 


Content-lype: lexl/olain : 
charset= l I 

Content-Transfer-Encoding: quoted-printable 


Content-1 ype . tcxUhtml :- 

charse H I 

Content-Transfer-Encoding: quoted-printable 


b6 Per 
b7E DOS 


<89ID44OBO1E2C94EBE988E74£E0C22i6Oi3B61EE@SMEOPi8EVS.eopds eop.gov> 

true 

-3 

(rue 

-1802070175 

1 

(rue 


HRC-1398 
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om: 

int: 

i : 


ibject: 


"McClure, Kimberly M" <SBUSTATE/SES/RECIPIENTS/MCCLUREKM> 
10/5/2009 12:20:00 PM +00:00 

"Jones, Paul W" <JonesPW2@state.gov>; "Sullivan, Jacob J" 
<SullivanJJ@state.gov> 

SSRAP_StaffAssistants <SSRAP_StaffAssistants@state.gov> 

RE: Materials for wh 


e just talked to Matt Spencc^.W^^ving it washfaxed now. 

--Original Message— •!' '•'*■ i V '■ 

om: Jones, Paul W ,., i : : !. 

;nt: Monday, October 05, 

•: Sullivan, Jacob J; McCIU^,' feVrto^rl'y M 
ibject: RE: Materials for wh 

2 -emailed and Kim will follow up to ensure they received If not, we will washfax. 

-Original Message— 
cm; Sullivan, Jacob J 

Monday, October 05, 2009 8:04 AM 
Jonas, Paul W; LaVine, Christopher M; Beale, Courtney A Kramer 
ity'Kt Materials for wh 

hite House is having email probs so can you guys washfax and re-email to wh folks? 


l.RIMJNT^p.MESS _ 

3EJD: SMSlg state.Sbu> 

?_RIM_PAdeO\FLAG: true 

?_RIM_MSG_FOLDER_ID: -3 

t_RIM_DELETED_BY_DE true 

CE: _ 

t_RIM_MESSAGE_SUBMI 

5IONJD: 

t_RIM_MSG_REF_ID: -1837087385 

l_RIM_MSG_STATUS: 1 

t_RIM_MSG_ON_DEVICE true 
6: 


r ;,; -S 

bS -Sta* 
b?id BOS 


b6 Per 
b7E DOS 
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-FW: FW: Final Pak Memo w/attachments 


Page 1 ol 1 


From: 

Sent: 

To: 

Subject: 

Attachments;, - 



TE.^ES AG/RECIPIENTS/TOIVNF> 


"Toiv, Nora P <C 
10/5/2009 12:35: 

"Mills, CheryFD': 

FW: FW: Final ppi 

Tab 7 - Proposed'Signature' Assistance Pi 
Objectives.docx; Tab 3 - Pakistan's Support 
FINAL.docx; Tab 4 - Security Assistance Pfr 
Pakistan.docx; Tab 6 - Current US Civiliav; 
PakistanStrategy Abbreviated version.pp&, T;. 
Approaches.docx; Tab 9 - Inti Support for Pafct 
in Pak Paper 10-04 pdf; 09-10-5 SEC-JONF^ 

n 


\1 - Riedel 

Stylizing 
ilSTMlbfi- 

- 

S interests 


From: Seal©, Courtney A 
Sent: Monday, October 05, 2009 8:31 AM 
To; fosv, Nora f; Laszczych, Joanne 
Ccs S_Spec.ialAssistants 

Subject; FW: final Pak Memo w/ attachments 
Iinportance:: High 


From: McClure, Kimberly MOn Behalf Of SSRAP StaffAssistants 

Sent: Monday, October 05, 2009 8:18 AM 

To: S_SpecialAssistants 

Cc: SSRAP_StaffAssistants 

Subject: FW: Final Pak Memo w/ attachments 

Importance: High 


Courtney, Zla, Dan - 


I Just wanted to make sure a copy of this had made its way to you as well. This is for today's 
restricted PC on Af-Pak. 


Kim McClure 
Special Assistant 

Office of the Special Representative for Afghanistan and Pakistan 



HRC-1400 
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•FW: FW: Final Pak Memo w/attachments 
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202-647-4134 


From: McClure, Kimberly MOn Behalf Of SSRAP StaffAssistants 

Sent: Monday, October 05, 2009 8:15 AM 

To: Dubose, Mary L 

Cc: D(L); SSRAP_StaffAssistants 

Subject: FW: Final Pak Memo w/ attachments 

Importance: High 


Mary, 


Here Is the package for today's NSC meeting (there is no Tab 2, as it is a TS doc that will be 
provided by ODNI). Please note that arf-Annotated Agenda was submitted to the Line on Friday. 
They will have the latest version of that document. 


Kim McClure 
Special Assistant 

Office of the Special Representative for Afgh«H$ 5 $gn and Pakistan 
202-647-4134 ’ 


From: Jones, Paul W 

Sent: Monday, October 05, 2009 4:09 AM 

To: Spence, Matthew; Sullivan, Jacob J; 'Kobs, David M.'; Tien, John K. Jr.'; 'Lute, Douglas E.'; Lebson, Eric 

CIV OSD POLICY; Chollet, Derek H 

$£: SSRAP_StaffAssistants 

Subject: FW: Final Pak Memo w/ attachments 

importance: High 


Dear NSC colleagues, 

Pis find attached a cover memo from Secretary Clinton, the State Dept memo U.S. interests In 
Pakistan, and ten tabs, for the Principals meeting on Tuesday afternoon. We would appreciate 
your circulating these materials to attendees at the Principals committee meeting. 


Note 2- Tab 2 to be provided by ODNI. 


Best regards, 



file:///E:/AF%20PAK%20Memo%20Emails/Doc%20with%20Tabs%20(CM%20ClassNel... 



„FW: FW: Final Pak Memo w/attachments 
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Paul 
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UNCLASSIFIED U S. Department of State Case No. F-2014-20439 Doc No. C05781399 Dale: 01/07/2016 


RELEASE IN PART B5,B6 


From: 

Sent: 

To: 

Subject: 


Sullivan, Jacob J <SullivanJJ@state.gov> 
Friday, June 17, 2011 8:18 AM 

H _ 

Re 


B5 


They say they've had issues sending secure fax. They're working on it. 


From: Sullivan, Jacob J 
Sent: Friday, June 17, 2011 08:00 AM 
To: 'HDR22@dlntonemall.comL<HD 

Subject: Re: 


R22i 


@dlntonemall.com> 


?l!! Checking 


From: H [mailto:HDR22igicllntonemall.com] 
Sent: Friday, June 17, 2011 07:52 AM 
To: Sullivan, Jacob J_ 

Subject: Re:_ 


I didn't get the TPs yet. 


From: Sullivan, Jacob J [mailto:SulllvanJj@state.gov] 
Sent: Thursday, June 16, 2011 05:51 PM 
To: H _ 

Subject: Fw: 


You'll get tps this eve. They're coming together. 


From: Spence, Matthew J. [ma(lto:j 
Sent: Thursday, June 16, 2011 M:15'PM 
To: Sulliyan.JacobJ_ 

Subject; 

I. 


B6 

B5 


UNCLASSIFIED U S Department of State Case No. F-; 


Doc No. C05781399 Date: 01/07/2016 


HRC-1403 



ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 04-03-2019 BY C66W46B11 HSICG 



I a-H* 


l : D-340 (Rev 4-11-03)_ 

File Number _ 

Field Office Acquiring Evidence 
Serial # of Originating Document 
Date Received ,?-|0 Zv\U> 


|- 302 - 

U F _ 

s& 


From 


(Name of Contribulor/lmcrviewce) 


b3 

b7E 


b6 

b7C 


(Address) 

' Uflsh»A fl'hsn-.J2g=_ 

.) (City and Siaie) 


By _|_ 

To Be Returned □ Yes O9N0 

Receipt Given □ Yes (D) No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes 

Federal Taxpayer Information (FTI) 

□ Yes 



b6 

b7C 


W, Aojfcir 



Reference: 


W ftes 


(Cormwo session Enclosing Material) 


b6 

b7C 


Description: 


Original notes re interview of 


b6 

b7C 


I A^i 
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ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-21-2016 BY J76J18T80 NSICG 


it 



^ pz. iU .,c /Jb>. l LMJ/h^-L! 


_ lc >_/_ AxfaJtz _ 


HRC-1405 



























^_ QojmJ. 


- Li2.dc 


f~\AXAlL3~s Qr-Z>, 

-Jzt^2A0.6 Jl- 


-kh ^^>— 






jA-^A>.i!s. 


5 W ^ 


^Ai_>6 i 4^> Ar 


^ IbggEf i£ EL= 

^5 /^^/Lr/7 st rrr _ 


TmJ* 


-^> *=r 


ZBQ 


iSIi 


.LC_£fejg__ _o£l_ 


MSC- 


^C5S] 


AA-^Kf^/- /U P^ ok/ HRC-1406 

■^3T72aJis^-I 

«=»<rvA ~£"E5 i V><£S’ 























Xsc*=i . .nT ^f? c a^CX j£X^-l 

_Il2±?-3__ lx<l^Z2^h± 


b3 Per CIA 




£~sAAAil_ ~2~ 


b3 Per CIA 
_b6 Per FBI, CIA_ 
"b7C Per FBI 



c=£Xt^ 


^ <r-iaVr -r 


A^j-{A^vj. 



I — 

U\CLP-{ 


CAt. L^—rry^ T _ ^JJUCj^A^—C.ii^xXi _ 

sXUr? -7^2_ ^S^J^jQfZJS^C Qlp-. '~n^_<^ rL 'ArflCW ^ ,_ 

~ ! = &£*d_ _ao/XL-,_gp__m tJk Q<^ f ~MrZ ^E g ^r<C 

_^&j^_Yeue__-&o^b_A_ tfefc^_oo *fW*^ . AjfeS /tecT* 



































ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-21-2016 BY J76318T80 NSICG 


b6 

b7C 


Interview Outline 



Professional Background 

Founder and Managing Director!" 


1(2013 - Present: found 


Various roles 




Educa tional Background 



uestion Outline 
Introduction 

o FBI's interest in the matter 
o NSLB disclaimer re: prior stateme 
o Can consult counsel if necess 
What is your current posiy 
Brief description of role a[ 



relative to Department of State? 


bl Per CIA 
‘■^5^ b3 Per CIA 

- b6 Per FBI 

CtO^ b7C Per FBI 



o How often did youNseofsUna^re with DoS? 

For what type of matters? A 

Who were you primary contacts at DoS wile a£ 


(Sj 

VT7TJ— (jmrdintth* 

iU-( U+4AC aA\ 

-o 


What was the nature of the communications? (in person, email, telephone) 
How often did you send / receive documents to DoS? n. 

• Examples of? 1 . 

Classified, unclassified? >StAXl i tLY\ 


o 

o How were the documents transferred? 
Did you ever email directly with Secretary Clinton? 







lf L 

START of emails 


/b/ib. oflfttfiitrruiliA 

Were you aware of Secretary Clinton's use of a private email address? Private ^ 

ser ver? b6 

Did | "l ever acknowledge to you he was aware Sec retary Clinton was using b7c 

a private/n on DoS email account? ^ ^[~ 


h* r CfTfanJr \tkC direct 7 


durinQ en^l..^ ^ M ? 


Email ffl j | (March 21, 2009) 



personal emaill 




b3 Per CIA 
b6 Per FBI 
’jb7C Per FBI 


s this the account to w hich you would have sent? 


(A»Yia-Cs Cicm-e L+f . 
iumt m _ 

Si rt-Y n<rxu[ 

••'ft o-c 

rvl 

- 


: orward to HRC from his 


Was it common practice to se nril 

fttynuaJ d-Vw<\ [&iuL-c \ 


hhis kind of information? 






/JCyUiimrr 

|a-ncia ^if 

Do( See 

HRC-1410 







CoJc 



1 •f"' 




Email #2)_|(December 30, 2009) frorr j | to Sectary Clinton referencing call witf[ 

o Do you recall how the call referenced in the email witl j [ was conducted? 


b6 

hlC 



(secure/unsecure) Assume "open line" means unclass? 

Reason for call being on an open line? 

Reference "details are thin and couldn't get into more detail on an open line.. 





b3 Per CIA 


>»'>■ 




Where/How do you draw the line between what can be discussed on an open line vs. 
move to a classified venue? 

Were you aware or did you assum j [ would forward the information on to the 
Secretary? 

■ Were you aware he would email the information? Unclass? From Gm|ife ? 

Account? CIA 

_ CIA, FBI 

Email #3j lEmall* (j^ ttferv 10.2010) b7c Per FBI 

o | J- was this the uncla^f^ acz^»Mnt you primarily used for work 

] — fVrt- a*L<[aJ bU ■ 

I l 


purposes' 


r 


JuntiCZ 

J(starting 


on 


Vo | lAAlUW 


Email #4: |_ |n Israel" (November 20, 2010) 

o This was sent from Gmail to Sullivan via Gmail... 


Can you recall why you emailed via Gmail at the time? 

Common practice in regards to Sullivan? Instructions to do so for this instance? 
you email Sullivan via Gmail vs. DoS account? 


b3 Per CIA 
b6 Per FBI 
b7C Per FBI 


■ wm, 


START of emails related t j I tENURE... 


b6 

b7C 


Email #5: '^p^Dated September 11, 2012) - B5 Redac tion 
o So-r: ‘ . :'the information a cguvefsatfon between ) 
Staff? CWlUcTtaflP*-' 


and the Joint 


b6 

b7C 


Any official documentation of conversation? 


■ Classification of material? 





HRC-1411 




Did you ever have concern regarding the transmission of sensitive / classified info on unclass, or 
non-Eovernment . systems? 

Any other relevant information? 

NDA 



Saturday, March 21, 2009 2:58 PM 
H 

Huma Abedin 


Sent: 

To: 

Cc: 

Subject: 


r 


I think you know that my close friend Jeremy Bash is now Panetta's Chief of Staff at CIA. 






b6 Per 
b7C DOS 


From: 

Sent: 

To: 

Cc: 

Subject: 



Wednesday, December 30, 2009 12:52 PM 
H 

CDM; Huma Abedin; Jake Sullivan 
CIA 


Separate from what's happening in regards to the Christmas attack, Jeremy Bash just called me because Director 
Panetta wanted him to relay through me that the CIA suffered a terrible incident yesterday in Afghanistan. 


Seven of their agents were meeting with a contact when an explosion killed them all. To the extent it's currently being 
reported, they are being identified as DoD personnel, not Agency. 


The details are thin and he couldn't get into more detail on an open line, but they believe the contact they met with 
them up and was either carrying the explosive or detonated it. $ 


They believe this is the greatest loss of life to a single incident in the Agency's history, and the first time that Agency 
personnel have been so deliberately targeted in Afghanistan. 


Director Panetta's at home in Monterey, CA, and likely returning to DC in the coming days. 


l 





From: 


b6 Per 
b7C DOS 



Sent: 

To: 

Subject: 

That's what he uses 


2/10/2010 12:17:53 AM +00:00 


"Sullivan, Jacob J" <SullivanJJ@state.gov> 



Fr om: Sullivan, Jacob J 

Toi l | b6 Per 

Sent: Tue Feb 09 19:16:28 2010 b7c DOS 

Subject: Re: Bash email 

Work email? 


Frorr • | 

To: SaSwafl, Jacob J _ 

Cc: l _ 

Sent: Tue Feb 09 18:31:51 2010 
Subject: Re: Bash email 


b6 Per DOS, CIA 
b7C Per DOS 


From; Sullivan, Jacob 

To 


Sent: Tue Feb 09 18:30:13 2010 
Subject: Bash email 


Can you send me Jeremy’s email? 


b6 Per 
b7C DOS 


Message Headers: 


Microsoft Mail I nternet Headers Version 2.0 
Received: from I I state.sbu j 


] 


Tue, 9 Feb 2010 19:17:53 -0500 
Received: froml Istate.sbi 


Tue, 9 Feb 2Ql Q 19 :17: 53 -Q5Q 


Received : froml 
Microsoft! 


3 


Tue, 9 Feb 2010 19:17:52 -0500 


state.sbu 

b6 Per 
b7E DOS 


HRC-1415 






/ C- ^ - Is V ^ \)\ 




Bash, Jeremy CIV 8DI_ (b)(6) _| 

Tuesday, September 11,2 PM 

Sufflvan, Jacob J; 8homSx. .SiwR; NUes, Thomas R 

Mffl Bf, Jam es HON Qsn PQUCV- WinrmfpM Jamaa A ADM JCS VCJCfi: KflHy. JnhnUQMi 
^martin.(tempsey | (b)(6) [ 


State cofleagues: 

I Just tried you on the phone but you were all In with S. 


After consulting with General Dempsey, General Ham and the Joint Staff, we have Identified the 




Assuming Principals agree to deploy these elements, we will ask S tate to secure 
nation. Please advise Sow you wish to convey that approval to us. j ...... 




1 

15-LR-0002 (Judicial Watch_K. Bailey)/DOS/000001 
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UNCLASSIFIED U.S. Department of State Case No. F-2014-20439 Doc No. C05792626 Date: 01/29/2016 


RELEASE IN PART 
B1,1.4(D), 1.4(C), B6 


From: Mills, Cheryl D <MillsCD@state.gov> 

Sent: Saturday, October 13, 2012 10:11 AM 

To: H 

Subject: Fw: This am Green on Blue 

Classified by DAS, A/GIS, DoS on 01/29/2016 - 
Class: SECRET - Reason: 1.4(C), 1.4(D) - Declassify 
on: 10/12/2027 


— Original Message — 

From: Reines, Philippe I 
Sent: Saturday, October 13, 2012 09:53 AM 
To: Mills, Cheryl D; Sullivan, Jacob J 
Subject: Fw: This am Green on Blue 


— Original Message — 

From: Bash, Jeremy CIV SD [mailto: ! \ 

Sent: Saturday, October 13, 2012 09:45 AM 

To: Little, George CIV OS D PA fc >; Reines, Philippe I 

Cc: Kelly, John LtGen SD < j Waldhauser, Thomas LtGen SD ^ [ > 

Subject: This am Green on Blue 


B6 


As you'll be hearing from ISAF, an Afghan NDS officer pulled the ripcord on a vest in front of coalition guys loading a 
helicopter. Total of 14 either killed or wounded -- some US, some Afghans. 

Right now, we think 1 US mil killed and one wounded. 


1.4(C) 

1.4(D) 

B1 


George, please lash up withf 


B6 
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t 

nbcnews.com 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-21-2016 BY J76J18T80 NSICG 
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EWS FEB A 2016, 5:00 AM ET 


Clinton Emails Held Indirect References to Undercover 
CIA Officers 


by KEN DILANIAN 

A handful of emails forwarded to Hillary Clinton's personal server while she was secretary of state 
contained references to undercover CIA officers — including one who was killed by a suicide attack 
in Afghanistan, according to U S. officials who have reviewed them. 


But contrary to some published reports, three officials said there was no email on Clinton's server 
that directly revealed the identity of an undercover intelligence operative. Rather, they said, State 
Department and other officials attempted to make veiled references to intelligence officers in the 
emails — references that were deemed classified when the messages were being reviewed years 
later for public release. 



Hillary Clinton takes a question at a rally in New Hampshire on 
Feb. 3, 2016. AGREES LATIF / Reuters 


In one case, an official said, an undercover CIA 
officer was referred to as a State Department 
official with the word "State," in quotes, as if to 
suggest the emailer knew the officer was not 
actually a diplomat. In another case, an email 
refers to "OGA" for "other government agency," 
a common reference to the CIA. Yet another 
now-classified email chain originated with a 
member of the CIA director's staff, leading 
some officials to question how Clinton could be 
blamed. 


Related: Judge Sets Hearing Date in Clinton Email Case 

Clinton campaign spokesman Brian Fallon said no intelligence officer had been identified in the 
emails, and that misleading details from the emails were being leaked to hurt the candidate. 

"This shows yet again how the leaking of selective details gives a completely false impression about 
what is actually contained in the emails forwarded to Hillary Clinton," said Fallon. "Whenever the full 
contents of these emails are learned, there is invariably less than meets the eye." 


Twenty-two of the emails were fully withheld from public release last week on the grounds that the 
Srtfprmation in them is "Top 8$srst," meaning its disclosure now would cause "exceptionally grave 
damage to the national security. But intelligence officials and congressional officials who oversee 



em are divided over whether that is actually the case. 


http://www.nbcnews.com/pages/print 
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nbcnews.com 


Page 2 of 5 




Nonetheless, the issue promises to dog Clinton's presidential campaign. Since the messages are 
lassified, people with the clearances to see them are free to characterize them as they wish, 
epublicans tend to see them as highly problematic for Clinton, while Democrats see the opposite. 
The FBI is investigating the security of Clinton's email arrangement, and the FBI would also have 
jur(js#$f©« i#jflvestigate the mishandling of classified information. 



), the Florida Republican running for president, serves on the Senate Intelligence 
^someone on my staff did what she did ...they would be fired and they would be 
prosecuted," he said recently. 


But Rep. Adam Schiff of California, a Clinton supporter who is the ranking Democrat on the House 
Intelligence Committee, offered a different view after reading the emails. 


"The determination that something is top secret, for many people connotes that these are the most 
closely held secrets, that their revelation would be extremely damaging," he said. "There are 
potentially programs that are talked about all the time in the press that fit within that category." 




Schiff may have been referring to CIA drone 
strikes, which officials have said are 
discussed in the now-classified emails. The 
strikes are highly classified but are also 
idely discussed over unclassified channels 
in Washington and elsewhere. 


"WHENEVER THE FULL 
CONTENTS OF THESE 
EMAILS ARE LEARNED, 
THERE IS INVARIABLY 
LESS THAN MEETS THE 
EYE" 


The email message about the dead officer 
was created by a Defense Department 

official, Jeremy Bash, who at the time was chief of staff to then-Defense Secretary Leon Panetta It 
concerned Dario Lorenzetti, a Fort Worth.na.tive — latei revealed to be a CIA officer — who died Oct. 

vest in a so-called "Green on 

Blue" attack. The email was sent on the^ 

Lorenzetti's association with the CIA wa^^^S^^ ^^^ ^iM>fBcials t tQ.feporters four days after 
his death and widely reported in the lifted until later. 

Some of his obituaries listed him as a 


13, 2012, when an Afghan intelligence 


ti's death was confirmed. 



"As you'll be hearing," the Bash email pulled the ripcord on a 

vest in front of coalition guys loading a helicopter. Total of 14 either killed or wounded — some U.S., 
some Afghans. Right now we think one U S. mil killed and one wounded." 
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sZifcjj 


-JEKaEl 


U S. ^ffewatic presidential candidate Hillary Clinton speaks as her husband former ■president'Bill flinton and their daughter 
Che^'|i|l(|>5ompany her at a campaign rally in Des Moines, Iowa January 31, 2016. BRIAN SNYDER / Reuters 

1 ilfil 

The next paragraph of the email, which was released Friday and posted on the State 
Department's website, has been whited out and classified "Secret ?.C$5cials who have reviewed the 
uncensored version say Bash was attempting to preserve the CIA officer's cover. But some of the 
language he used, now that Lorenzetti is known to have been a CIA officer, could be read as a U S. 
government acknowledgement that CIA officers pose as State Department personnel in a specific 
country, Afghanistan — something widely known but not formally admitted. Therefore, the section of 
the email was classified and^bsc&ed from public release. 


Bash, who was Panetta's chief of staff while Panetta was CIA director, sent the email to four people 
— including George Little, a Pentagon spokesman who was a former CIA spokesman, and Philippe 
Reines, an aide to Secretary of State Clinton. 


Bash ends the email by instructing Little, the former CIA spokesman, to "please lash up with (blank)" 
— presumably either the spy agency or one of its employees 

Reines forwarded the email to Clinton State Dept, aides Cheryl Mills and Jake Sullivan, who 
forwarded it to Clinton. There is no record of Clinton commenting. 



"IF SOMEONE ON MY 
STAFF DID WHAT SHE 
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Bash, in an interview, said the em.^*p? not 
lassified when it was sent or forw§pl§| and 
'did not reference the individual's name, 
employer, nor any identifying description or 
information." 


DID...THEY WOULD BE 
FIRED AND THEY WOULD 
BE PROSECUTED" 


Once the CIA posthumously lifted Lorenzetti's cover, Bash added, "the original unclassified email 
could be read to confirm the general use of cover, prompting the redactions we now see. But any 
suggestion that this email contained confirmation about the person or his cover, or any inappropriate 
information, is flat wrong." 

The 2012 email wasn't the only one referencing a CIA officer or program, officials said. The 
references were indirect, and Clinton made no comment about them, the officials said. 

Some of the references to covert intelligence officers, and other discussions of CIA drone strikes, 
were against classification rules and were "sloppy," one official said. But views are split on whether 
they were damaging to national security. 

It's unclear, the officials said, whether the emails would have provided significant insights to foreign 
intelligence agencies, if, as many experts say is possible, Clinton's private server was penetrated or 
hacked. 

^The messages at issue are part of a longstanding pattern of senior officials at the State Department 
and other government agencies trying to talk around classified information over email, sometimes 
unsuccessfully. 

What makes Clinton's case different is her use of a home server to transmit emails about 
government business. The issue has continued to be a factor in her front-running campaign for the 
Democratic presidential nomination. However, given that the State Department's email system has 
been penetrated by hackers linked to Russian intelligence, it's far from clear whether the material 
would have been any more secure had Clinton used State's unclassified email system. 

Clinton and her senior aides had access to secure messaging and telephone systems, but they were 
not as convenient as email. 


As the Associated Press has reported, State Department emails previously made public show a 
history of classified information slipping into unclassified email. Examples have been posted on the 
State Department's website in response to Freedom of Information Act requests. Although the 
classified information has been redacted, it is possible to glean insights into tNVf’G-sitivity from the 
context. ISteJl 
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In emails about the 2012 attack on a U S. diplomatic facility in Benghazi, Libya, department officials 
sing state gov accounts discussed the movement of Libyan militias and the locations of key 
'Americans. 


An email from diplomat Alyce Abdalla, sent the night of the attack, appears to report that the CIA 
annex in Benghazi was underfire. The email has been largely whited out, with the government citing 
the legal exemption for classified intelligence information. The existence of that facility is now known; 
it was a closely-held secret at the time. 


In five emails from state.gov email accounts that date to Condoleezza Rice's tenure as secretary of 
state during the Bush administration and have been publicly released after FOIA requests, large 
chunks are censored on the grounds that they contain classified national security or foreign 
government information. 


They include a December 2006 email in which diplomat John J. Hillmeyer appears to have pasted 
the text of a confidential cable from Beijing about China's dealings with Iran and other sensitive 
matters. 


Large portions of the email were marked classified and;C^f%qr r ed before release. 




Clinton insists she didn't send or receive information marked classified. But she signed a non- 
isclosure agreement acknowledging that information can be classified regardless of whether it is 
'marked or unmarked." 
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C05843828SIFIED U.S. Department of State Case No. F-2015-05052 Doc No. C05843828 Date: 01/20/2016 

Obtained by Judicial Watch, Inc. via FOIA 



From: Lukens, Lewis A 

Sent: Saturday. January 24,2009 8:26 PM _ 

To: Kennedy, Patrick F [RELEASE IN PART B6[ 

Subject: Re: Series of questions 


I talked to cheryl about this. She says problem Is hrc does not know how to use a computer to do email - only bb. But I 

said would not take much training to get her up to speed. j 

i 


From: Kennedy, Patrick F _ 

To: Lukens, Lewis A; 'habedlrj 
Cc: Smith, Daniel B 
Sent: Sat Jan 24 20:22:20 2009 
Subject: Re: Series of questions 

That Is why this is the best solution 


\ ’cmill*j 



(REVIEW AUTHORITY: Frank Tumminia, Senior Reviewer 


From: Lukens, Lewis A_ 

To: 'habedirf - ; Kennedy, Patrick F; 'cmlll^ 

Cc: Smith, Daniel B 

Sent: Sat Jan 24 19:49:30 2009 

Subject: Re: Series of questions 

She'll be able to. 


B6 



B6 


B6 


From: Huma Abedln 

To: Kennedy, Patrick F; Lukens, Lewis A; Cheryl Mills 
Cc: Huma Abedln ; Smith, Daniel B 
Sent: Sat Jan 2419:48:27 2009 
Subject: Re: Series of questions 

Yes we were hoping for that if possible so she can check her email In her office. 
-Original Message- 

From: Kennedy, Patrick F < KcnncdvPF(g)si:ue.unv ? 

To: Lukens, Lewis A < LukensLA@slaic.gov >: Cheryl Mills 
CC: Huma Abedin; Smith, Daniel B < SiniHiD2r»)5imc.i:ov > 

Sent: Sat Jon 24 19:29:25 2009 
Subject: Re: Scries of questions 

Cheryl 

The stand-alone seperate network PC is on on great idea 

Regards 

Par 


I 


i 


I 


From: Lukens.Lewis A_ 

To: 'cmillsj_| 06 

1 
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CO 5 8 4 3 8 2 831FIED U S. Department of State Case No. F-2015-05052 Doc No. C05843828 Date: 01/20/2016 

Obtained by Judicial Watch, Inc. via FOIA 

Cc: Tiabedii_ i Kennedy. Patrick F; Smith. Daniel B 

Sent: Sat Jan 24 19:10:33 2009 
Subject: Re: Scries of questions 


We have already started checking into the NSA bb. Will set up the office across the hall as requested. Also think we should go ahead 
(but will await your green light) and set up a stand alone PC in the Secretary's office, connected to the internet (but not through our 
system) to enable her to check her emails from Iter desk. Lew 


From: Cheryl Mills 

To: Lukens, Lewis A 

Cc: Kuma Abcdin ; Kennedy, Patrick F 

Sent: Sat Jan 24 19:03:24 2009 

Subject: RE: Series of questions 


so I.have now rettfi up more on POTUS' bb (which appears not really to be a bb but a different device). 

illiSft® 

her being able to use an encrypted bb like the nsa approved one he has in the vault and if so, how can we get 


and if not, let's set up the office across the hall for Iter to use - it needs a phone etc. so she can go across the hall to check her bb. 


edm 


From: LukcnSj Lewis A f mailto:LukcnsLA@si,ue.i:n v1 
23, 2009 6:54 AM 



uesttons 


QdStrdiiS*f-a8a , 2‘S 'yes. Will give you more details this morning 

On the bb for hrc, can we chat this morning? I may have thought of a workoruund but need more info on her bb use from you. 
Lew 


From: Cheryl Mills 
■To: Lukens, Lewis A 
Stjml: Fri Jan 23 06:47:59 2009 
Subject: Series of questions 

tow- 
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C05843828IFIED US. Department of State Case No. F-2015-05052 Doc No. C0584: 


Obtained by Judicial Watch, inc. via FOIA 



:e: 01 / 20/2016 


who con I talk to about: 


1. can our email be accessed remotely through the web using a non-DOS computer like my laptop? 

2. I am traveling to the M-E tonight - will my DOS bb work (hero and is there a cell phone attached? 

3. spoke to Dan re: bb for HRC (and repons that POTUS Is able to use a super encrypted one which) 

4. spoke to Dan re: setting up Counselor office for HRC so she can go across hall regularly and check her email. 


edm 
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C 0 5 8 4 0 6 7 5 u s - Department of State Case No, F-2015-05043 Doc No. C058< ^ Date: 11/05/2015 


RELEASE IN PART 

B1,1,4(G),1.4(E),B7(C),B6,1.4(C) 


■«.V. .V 


DECL *' 

. ♦>*>V* 


CHERYL D. 

>_> *“4-^ •'’»*- * " |- 

FROM?; . 


MILLS-S 


REVIEW 

JauthoruT; 

' •^'^Barbara Nielsen, 

1 4(( Senior Reviewer 
B1 - 


SUBJECT: Use of Blackberries in Mahogany Row 

. We have, worked closely to review all options that wo uld_allow 

Secretary Clinton, you, and a small number of staff to use Blackberries 


1.4(G) 

B1 


- Our review reaffirms our h eft "f that the vuln erabili ties and risks associated 
with the use of Blackberries in the Mahogany Row | [ considerably outweigh 1 4(E) 
the convenience their use can add t o staff that have access to the unclassified g 

OpenNet system on their desktops. __I 

We also worry about 

the example that using Blackberries in Mahogany Row might set as we strive to 
promote crucial security practices and enforce important security standards among 
State Department staff. 

As an alternative, we suggest that DS work with S/ES-IRM to make access 
to the Secretary’s OpenNet account on her desktop workstation as easy and 
convenient as possible. For example, we are happy to work with IRM to lengthen 
or even eliminate the time-out function to allow the Secretary’s Special Assistant 
to log-on to review her emails and schedules. 

-While we cannot recommend using Blackberries inside the Mahogany Row., 

we do not want to stand in the way of issuing Department Blackberries to 1 4 (G) 
the Secretary and her senior staff for use outside Mahogany Row. Those B1 

Blackberries can be synchronized with your OpenNet Outlook accounts, 

provide full cellular, e-mail, and internet functionality, provide unclassified 
mobile technology when £qu-ore away from Mahogany Koto; 


I cannot stres 
highly vulnerable is 
retrieving e-mails, I 


ly, however, that any unclassified Blackberry is 
to remotely and covertly monitoring conversations, 
ig calendars. I am attaching reports from DS’s 


■P. O 1 Kpacnnc I A (f*} ATllI ^.V 

UNCLASSIFIED U S. Department of State Case No. F-2015-05043 Doc No. C05840675 Date: 11/05/2015 
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Office of Computer Securit y’s Cyber Threat & Analysis Division that give further 
background on those risks. [ _ 


1.4(E) 
1.4(G) ‘ 
B1 


If, after considering the vulnerabilities that I describe above and the 
alternatives that I propose, the Secretary determines that s he wants a limited 
number of staff to use Blackberries in the Mahogany Row! 


Attachments : 

Tafi 1 - Excerpts from DS /CS/CTAD Reports on Blackberry Vulnerabilities 
Tab 2 -1 I 

Tab 3 - New York Times Article: “Obama’s Phone Security and Yours” 
Tab 4 - Washington Post Article: “Your Cell and Your Berry: Tools for the 
Enemy” 


1.4(E) 

1.4(G) 

B1 



i 


i 
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Eric J. Boswell 

Assistant Secretary for Diplomatic Security (1996 to 1998, and 6/2003 to 12/2012) - 
Director of the Office of Foreign Missions (DS/OFM) (6/30/2008) - 
Assistant Deputy Director for Security ODNI (2005 to 2008) 

• Introduction . 

o Voluntary / Can stop at any time v/ 

o NSLB Disclaimer re: Garrity / not interested in prior statements to DOS 
o FBI's interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. 

o Discussion of classified topic, if necessary 

• Brief overview of duties 

o What is your current position? 
o What were your duties at DoS? 

o What were your duties as the A/S of DS, as relevant to the security of the Secretary's 

communications? 

• Knowledge of $he private server, email system, and other devices? 

o Did DS have any role in the set up, or maintenance of the server? 

* If so: 

• What was there an approval process for the use of private email / email 
servers? 

• What steps were taken to review the risks / benefits of this 
arrangement? 

• Who was involved in the review process? 

• Was this consistent with DoS policy at that time? 

• Did the server violate department policy as stipulated in the Foreign 
Affairs Manual? 

• What is the current policy today? 

o When / why did it change? 

o What role did DS play with respect to providing secure communications to Secretary? 
o Did DS provide any guidance / recommendations on the use of devices? 
o What secure comms were available to the secretary at her home and when she was 
traveling? 

■ Phone, Fax, Email (Classnet / JWICS) 

• Discussion of Memo 

o What was the context of this memo? 
o Who requested to use BB on Mahogany Row? 

■ Had this been done by previous secretaries? 

• Why did she need her BB on Mahogany Row? 

■ Do you (or DS) know of requests made by Cheryl Mills for a standalone system 
that wasn't on the DoS network? 
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,c 


ft . 

3^. 






SL/ 






v° & 


It appears that the issue is connecting to private server / email from DoS. How 
was this resolved? - i.e, BB on Mahogany Row, separate computer system, 
other? 

Can you please explain the last paragraph? 

If after considering the vulnerability that I describe above and the alternatives 
that I propose, the Secretary determines that she wants a limited number of 
staff to use BB in Mahogany Royv Redacted] 

What was the Secretary's decision? ^ ^ 

References to Office of Computer Security Cyber Threat & Analysis Division ^ ^ * 

What were the primary threats facing DoS at that time? C4 A.SS'Yt) 

How was threat information relayed to the Secretary and her team? I^j^a / p£, 

Are there any specific threats that you recall? | ffr M<W> 

Were there any other issues or concerns regarding general security posture of 
the Secretary and her team? (i.e., Egregious actions, not minor infractions) 

Who was the primary POC in the Office of Computer Security Cyber Threat and 
Analysis Division at that time? 

How does Office of Computer Security fit in to world of IRM, IRM-S/ES, PACE, 
etc? 

Is there anybody else that we should talk to regarding this matter? 

Any other thoughts / concerns regarding this matter. 

-h 

\)C ^ cloW-c J ■ 




NDA request 


^ yyA.i.'h-tS 

0U+ 




HRC-1433 



ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 04-08-2019 BY C66K46B11 NSICG 



(Address) 


By Jft 


To Be Returned □ Yes (H No 

Receipt Given [3 Yes \33 No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes 

Federal Taxpayer Information (FTI) 

□ Yes 


EfVlo 

□'No 


£xA/A 


j Reference: 


3d i 


FD-340 (Rev 4-11-03) 

File Number 

O o 

i A 


-Joz 

Field Office Acquiring Evidence W ^ 

Serial # of Originating Document 

V) [ 

Date Received 

/2/^z/o 


From Of 

A A(hcj^o 


J . 1 (Name of Conlnbuior/lntcrvicwcc) 


ASM 


(Communication Enclosing Material) 


'■ b3 
j b7E 


_ L _ [ _fPilv nnH State) 


! 

t 

i 


b6 

b7C 


Description: 


0” Original notes re interview of 

IVs ak. A < /k fa weo 4 c, ie-s 
fU /'I i 'i i / 7) T~ 




HRC-1448 



%r 


ALL FBI IHFOBim.ieSi^^r?.lilEO 
HEREIN IS UNCLA^i^lSB- ' 

DATE 11-21-201 GiS'VS;«i|-3^80 K 




L, 

Z2f/P 


',^•,*■8“ «"ic/ _ 



H/rslC'." f S-fc*.U. 


b6 Per 
b7C DOS 



i.-, -f'svr 


^1/2-06% JC uj Pirts CUlo^ dftht f£-4„ u/H') ■/- ^ovi&l _ 

U/aS Cs^ D,r ^ CtA. !!(^ /{j l,M bh. hC- ^a, / , lA-C^Jtjb Ou/~ Orf- 


/. C~~ SjJ/ A;*, e-Q Qft fkJSv. 




















































































Jl)z2.U£- _ 



?OQ ? - taoAced a* ate ***.*, AL^-h s*'/d ''A/ 








































•/ /huolv<jj 
_ u jU-L^t C I'nk 




'Z . 

_ ]A )Lu~- I in j-J-'Yt-t rn rtAP cA'° 


-L*- 6 ^ 52 -/ _L^-e=$> 


-r**tll._&&$. -A> Sh-tesJ OLS _ 

^ CjD t IAa.?c(^ 2 QiA. 4? !C ( G P 


Lai^gif.C_J~TL A^-e-^-i- L ___ 


_z 


-ZOv 


2o 


2 6 11 5-^^^. 72^ *,y, 


^Gsco hJfi 


uicU- ' 


(t-tr&^u 




&GA 5 _ 'Se^ c y f <r 

tf-e-yi£ Z^c/ 


rlt S' C 6///_/ 





-6- f=>Q Clpi-f-S. 7& -> -e^ 

u,<,/o\S 't s -ft~es AJ/)5 


~l£&h. t~ W _ 5^ wj4x| — r^'.ccgi-t loi>{-c^e.-ir -Gl-kts- b't+jL*- ~(u (s>cdujjfify 

_ ^ ~tU/.A- _X Vi ~/V« Si 0 >-\ /'U' d*0-y _✓ 6/<6-6 

|-VA/- fg R/ i, - y 0 _ ~ _____ 

_ BP- ^7, L.<1 tA10 ---g. ~fj*--xiloi l‘+y_j-o cysc^ldz CL_i( . 0 tr__ 

-°-P uso+ tftcL Ink e^:i f Jsle-uJ I) 


























































































































f\-yp S*i/a/ /*<V /«*</ P/iv <Av. 


T /^'frtf< P-f ~ Z Pi A- &A. / — fA<A*. f**. Z e/lfy f A. <t./. /a 4, 

{■ i I ^ ~ ' ' “ - - r — —- 


/Mr: 


7/ // ‘A 1 *- /*/ «<•// 7>A Y 


' j/Z V A>J }/pt/t (/*/ 6. rf///y /&-/.■* y /-/ sCs/aV /KySZpt. /»A. 

\f~y P/Atc/itc, . 

_ Sh Md faA«S - (/•-/P /«*<</<■ a* M/i^k s o*P, -rstj //.*.. 

r _ t r A A.a kiP*'^S/ a/v S-Y /j/oaVX tlOC>. b7C 

/ft// y/jJ'^/ eSJ - 4<*-/( a/sii/t pj/t/ *h <Z /* ZrZ /A. 

//at y c//o f*//*//<tY // i/^* y.P ZaA ■zfkYiAf y> //// 

//a pAOAh yjfl/jV /hS ZP 

f /fP/< /f7 Mty/'e/ln. ~ (/< {'■•Pc/ z/ t/<S <. £/ arsY/AP/li . 

Ij j’oAf oJjtyf /a /X. *' 4 . cjo-P PkP**> fy 2 aX p^uc /ou.y & 

! Pl\ % A 


YJtn.'/' PaoV /o J t/<r/ CaA/t fc/fj P /PP. 


PX**/lP /P'2 Z PZ /(fofP*- A/o/X.j A ZP?Ay *cP/y- j/tepfd. 

If//ii\ /*iw<A j /o *-/</ ooX - AY* <P/-/ri<Y rfAoSy . 

P/Si gt^/tn 7c A.O'St^j A f</(A<*y P*P -SU. /k Yv^cY /o/t/urpei . 

_| //4 V U *~t /. /^V / f/yo Cai *-C/-efJ J'&ut/'-C 

| - /*jS( /( zpzpzzz... :i;.:;. r.zi] 


jjf rv^- ■• /Ca rfi*. Z /a*P- €*Z/ fysPtii. p/tf^P/ Ptj*s<Yj* tf*-j *■&/**/ 

S<A*f. /UTO-P-YAm. P*f**Jy Y/Zo W ZZr . AAr«J^ 

Z ' pmdftth/Aj- 

J-' ZfH) J /I'M- /Ky aZ Y<~/t J>pZ . (PtJ. PA/P ~Y/'$ A ("ft Zjcf.'Z* r 

_j A /*sf. ?/*/■ jt>oe( 


HRC-T466 









Mi. 






' J.'tfc/ 'Loo}* // fly (£•’}(. /'o< cJtd fey&t. 

_** * e **)..o'tf 0 jrf** #j **• --mm- 

•'" /ty'*/ ATftff - 4^0^ /Z A A ^ ('*•'//'•'( d.-Zr^Y A»< /list. 0^ JT. 
Xfa(yo/\/ </aJ ft/A//1+\ - Y/A6i(Z (J<A />/* 4/r<f J - /Ji st£ c/tA. 
f e < - A/<? fra^Y /H+i*. 6»)f' /</<■ fa /et'S'/^ <*-<//? fa/PCriZ~ 

6>f. m^/A /CfS *es ynZ/Sds/ 


lift!! 

Wm 


si ft 

Slr^f I*** 


JJ 

-i 


Xs( cs*-/f. 


b7E 


1 7 1 

— / /a-Y */y i/*r/tA /•■'fat.’/£ \(Z/€A**[ r*sy*y^. JO AffaX Jfa /f 

//« rfaj- &( A*/ sfa X.r- //?/"' . AY^Y z/^Yc m*/ Mf i»/°. 

ib*+/. Jofi t/tfoJ., /Jofy'j »Y jZ**Y Zutosfh . jA •ZZA Al t 'cnS»X/ J‘U-y 

cx /fa)P - Am /4 - >£«/ *•/ fam o/n Y< . /€# o^t < a «£' 

fiAt/t*. Ac/f gufy . X/*v4>0^ ZtXtA +«%' y> - rrAX/f fat. Ary ' * 

f/?t*. XX rfhen. 

" s~'f' a<Jk 'SfAftCAjY^i/Yy . A^*y^YYj qXo Z(J>»A. A' A-^z 

YV <«/ : /^. 

I'jfMtf r^'WA. $Y/} JX-ty /yj A */rY 7Y fas AXY-eJ fy'/h . /PA^'y, . 

$ A/) Y jkf/ftftJ OLsffatf . jymX A fa**A- A*. yy/'+At X'ZttfS/ot ?*//. 

/o r 'j sytf*. p/lf A*‘J AA/. A./ A) (J/fYJf, & /S 

'Or. r$f<+*ly Y*x! f£/ A-,/ A/#/ fyz /y Yjh<A A r^yJl //V(o*//,/y? 

A lt! ) 0 /<r * AjtA y A •_ p- o/. YjJ^X.!) ^ V X- _ _ 

- JC Za. A A/% A X'Jy % /i*y /U//voYj , 


OJSJ 


b6 

b7C 


Jo c/Y 4»y/ /iZ/Vily. _ _ _ 

yt.yJtfor/ y»/J/tJ. ~ _ 

/ C l*'-/J Yy < ^ Yy/ //@ . vA~ J' (/A of Y*\0(/ A* a\. 

/v+-fe( A* A^Y A~ YnrfJff/oX A'' <s*Zf_ 

YfJ/0 r\4*y(*et/ S4~/i( S?J~£ v/ /?/// 

7<UX -a X//JzY'<r. 77-7 ott i/c/ etyfA/ / 7U /n fan tY t 


HRC-1467 — 










r ffjtP /ft*'/ a o7 _ 

f fa ///j /*■/</ A J*. eXf+lltc/xJ-U/A . /~/ t'y i*K 2 Jcr^z/lK'a\r- 

j &/<*( 72. flj /Jt*-. fffsioij /><*&/rse/. fflufoe. 

_ r Jl i/o' <f*-M fa g J~/X Ji/\ *2 fi/rf/eA'S 

• ’ /1/*"//[ Ay 7 /*/£ fa JP. 6>i too/^ej. /k o aj/o</ faoj/*s/c //&'. 

_ j Uo/l^k ' : /Ja/a <*.< / //e/ s/h'M - U* 7*^ /* y. 

Jl ffatty// MX //f^/j. 

[' 'ffttkt/ Xl «* S\S 6 s//ntt . 


/S*/K*g v/«- °X Sj S&fsn/j .____ 

//\ Jvtunes *7 Zodf /a* fitx/ m *ss»**// //<■/ s*. J 7/. /*sfae/ 2P 


U<J %> //, M-ffayfa /<A 'CA4</^4SJ<>4</ fa**/. 

- /fa92 2 £• ^rZ/K/^ &>*»/'s+~ 


- /fa*^Jtd 4 /»t «//<s 


/h. (fauAA/S fapofa At \ ~ *7 ^ 2.y 7 /XX J. 

• /£/V ’jZ 4 U A ^7 J '/’/°oS' TaoO cA**/ x//^/i(y ftue.,/. So*, ^/Cr/Z. 

fld'.'f food 7*o fy /**<) t>X*o/ /f£j0 / {A.**/ &fa S*/<&Hs/y} 0/ J/ 

I Si as*. 0*4*1 J.*// jo** /Co/Astfajf. /ffaj</ > | _~| XreS* fas<o)ft ^. 

_Z*J So* vis'cYt.l, - vJf *J SdA'tr 7c/y a. /(So-/ zt/u. X^ /✓✓.£ . JL ¥ 

_ Jit/ fa_/A*4S fi'Sf/f. - Z\k Jos 2 fafat Pool / *p^ e 2 o/ 6, fa 

_ fa ft '( J //J- < </ / / (/fy/fa^' / ^- ^ /*./ 6 Jits’ // /'J J//. {//? 

'S 'rJ c0 7 *J_Joh. /w<* J /ts* tA As d/rfse . JfaAtfas faffayytxfa}. _ 

\fa fa 1 *t«fa 4 7 ao</ y++e. //kjr 4*.e **/+./ fa 72. . ^ 

Jj 4 a (f/Pjfao *i. <// ;D X<C~s ji \ / &'X tfoj- ./ ('ZcjpHf+A • 

' /X 4/ A9j*.yfa*J iJ t*/o'A c/o( (JtSh y 7*y Jok//~*Zfa(( 7oo & falou t/^ 

Oi/a y hod jZ</a.k a/•./( ,y - yzoyi / 1**./ o<S yO</~S<*.cf. 

/4f*-i/. /M. *///'/* Jj. i-, . 

-- --- ---— b.y - - - •'——— - l 

ft . CoA^~ (S</~ ¥ /t'/sft/ -fa S/lfc. fn} -1 


y_rv-^. 


FfRC : 146B‘ 








r d/T^ v A\ f+AAtjftL *-( 4 /A' % Z'/AkYt*Y (oJsresYdt to./ 

M. 

t ft*/A(S*rt /&././>/ /’//*}*' /m. *./ 44^6/ e ,,'% of*/ 

| 0 , *~/J- /kueiZZ JZ, . 

jj /' fokfi+t/ - /Jo /('oft " (oav-O' CS!/\ J 2 . //( (/<X> fc( /'lY*+A* r ' ) A / 

]}; / d/d , fro?. ■/'/**/{• ^ is>/0 - Yadfy <^Jly . £*//- s?zoa<J/< sY</ 

Zofl- 'fr*',/iu x 

$*.<■(*■/ Y&Y Zo»f -aCA'/600 y^sY//-/<Y‘/£oj. Mo '4 

jj /(A/O' *(*(/ ^ a, v/c' . 

tj /10 /'(tufY Yse*t/tf /fYb/ 0 Y ///V 0 j/f a o/4r<* Yr/Csf. AJ& fA+'Z 

■T — . / / r, / I I . . * 


/. /tjf \ I '/YeS</ % Yb\. 

! a«» j<4*\ i rf/Z/ A/yA /Y/TTT^ 


v g .--- 

rio Qr^fl /y /* :'c : 0$S i -~£': 4 /ft/V^ Ao^'/' ro*£ /Wc*> dx-e. 

•’jhfewr.'- • --- -vf * - - • . Y - 

•: f. C'K't/<Y l/. //»t. #■*% /*■ Z//> Y<c/-X? ^ 6 /y<> /> ^ 

-’*-... . ..... . f'.... .. .. /r.. 


o/V / Yfy. VJ/ " yo'K'M / ^ Y>s/-Z 

%-kY ^ s-/</l 7~k< Zo/f - *//tY Aa(A.*rt Y /zYYo 4J//S 

-/✓--- - • / - - 'W^mWm" -— — ■ ■•*■ ----- 

Yyf yZcY YffA //etYA.// 0 /£/*•£/ -y’' yYry-'p^W/y /*»/e /u<ov( 

r ^ y _* . .. / 


f - ^ • V w 

Y'/i to// ''fy/jfer. /J^Y/'s cove *o*~ /*ye// */ Sa/Jv*^ )/»y/Y Yofyt/s* 

6o*jJ/ /o^uY /YAr /*<. Z///o. AY. //</ 

{ Z t n 0 // fatA C/. 

I ek'<Y^ A/ j// 0 ~t />*//. A 4///^ i/a/ Av a, Z// f:b Y 6.0. 

//•A '/pj/'a./f 1 /^'^y* JZ /> ty/^O. 

^ ^ ZAY _ _ _ 

2 *./*-iks - JZ. c/ M. 


&yp'Y' 


A\*j A*+( /•** 


y^Y/ Y's €ka. 7 cJfZ\ /?<>s/'y. Y 06 Y. 


£s tfeos/. . 


I.f 

iT /'y? f't O**/^/} Yo s a ~s u '</~■ 

tr-z - mm-' ■ - .. 


b6 

b7C 


b6 

b7C 


''~RRC-r4'69- 












' yJo(/A Y-fi i/o • AaT 4'?<#// /14/HS/ r P** 1 / Pkt>o P't 

/*. a a A t i . / V/ 


*>$V^ WffKCf- &»*>. _____ 

l//yj fw-ts/r/: /\S'/< />'<■ Sa//*>*J A*. /y //s'/P yjf / J<s _ 

___ . _ _ 

P/tt-Zll StA^y /fl***(*% */»~P a P-P ^A-S /*6>4/*«?/*, d^y/oesp 


pc U loof jj. /fitfs/A /*//,a eort'/i *"«(*_**/, < M. 

//> yfcy/Jy'A #/(*<? K+*. shiyd- __ 

/fl*‘/l’t>x s-(<AA/‘h. - S'l*on - ot -/oP fe/t *£>*>. P " /<aa »y A" o>t*XXeS. /#*>■&■ /*fa>/f. 

7 i yy/i <y /tey. /% {'*+$*& s/* qpj i>oi 

_(pp faoo P »Mj fJA-,- yu /»/. __ __ _ 

/{'W <«<JJeJ /VA/ 6ises*</: % --v'/ 


£y - 7/0?" ms/*/ a</&**•/. /?/*</ y&/y t r'asz/f A0/ y> 

ft//2 " Je/^ts f *<£ yyS-</t. __ _ „ _ 


_ J* y sjj My. \ 1 'P& pP A# <// / 6 As<_a/yt/v<r. 

rOose ftp/t jti Anh</ f/fl. _ .M/xw j \ | t k/ves/. _ 

_ J‘^ /e y“t/ P M tp A,A%*(x- y/<p<7p. 

jft.fi sa »/ ( 'd* P*y/ PnoJ /oc?rj^/Ar. Zb Ao/:*/Ay 
1/OhJ.O/J. ~ / (’Aa/r/'t/df. /y/*/ /*S ^ y?/A/*A . /j’a.'A A’A 

I ^./YlAc/f tjtc/f' toy./ 

- pp^i Ptf* fa a yp/ifi. " jptj/vpj- yttf<Ps• 

~~ cAj A / / K « < . 

- /oA*' P/Pe/ r/i*t p/e 















Pm 


./(AA' 7*# 

YYAsMtAftAf - /S'/./A ft»jtoi/e/l fat </*/jo<\ /> . 

//•'JJltftdfa ! r t'f \f£fSlf erf /& «-A Jw At/Y> /I 

_J 4<s / fto.~J. //oYas* c/ t /f /e/-jp. eftte/s &<SC /A+< 

aJ~ fti/y. yi Aw/ ///*[- ^ aa&a s . 

^ 1 ** 1 / 6>s/\(Sf ' ft < Y '-'l -4 *A*A ^e/U<t \ . 

AMf A</ ft)0 6ft - 'fkSjji'/ fo~/Y V /to. e *'$//'. ft<s</t\ A'ju, 6/A A 

■• AP /*<' •/*/a/4 ,/ /a )i(</A /<:4A. ti/e f<dfcj yA-/yc<YeY Z/YAa. 


/Acjii 

://?/W; x ^y__ /b/Us&*'<6 04 A .j^ 

T fit [lot/ " ASekiK £**>/ of/A*f~ 



zj/cY/ j yi 


y/*Yft fto 


r ot/h - e^a -7- j | eysAt'/' A* A //*y Aycyt ,. 

■*' ]//% \ - 

y A///. ~ fat/ /» A At £/*y<f A^p&Y Y'yo^yyZ^* 
A> fa/l 2o/\ Yl/Yikj y/sty 4. A°i/4*) y -'‘(i ?gt' r ,'M 

/r/ st! !./ i/ „ Ai . A , y . '* . ®a5 m 


'tfte&./'T.. .. be 
Mny~~r , b7 


b6 Per 
b7C DOS 


Y<+*). Alt J/YaY 1>4A'/ A'/tK'p/fJ&O/i 

J. ... 1^11 *j| "' 

1 :../^y <2^.t. syp.4Y.jty/* Y/K*tA. A> 

0 /<•/ ^ 4/^y A/A/. A finju<rs<Yi\s </'% ft ' A/a/ 

_ l/c (l Ytrt) fafae Ai /4^_ [*/ /K ■'■;/. Tpot A Al^rt /<P toot 
- /t/<> «/Zc^~ /\(40'J '/ft Aft ftrt/J 


Yft i 0/ J ft/y y /A_ A s*j/ Yfi/J y*y A *&'/<._ ^ J y Z^^/os-c 

ft/itt i/’-tft /<.*( <,/{([. 

■ YY}. Y^ <t»'-/Yj** m’A /*AyY fa*A~ /J/Y. floAr, 0 ^ e A 
j''<*//)>* o/ 'a.j . /jYy /yyA /m Yi*i / y,A y 


HRC-T47! -"■• 

















b6 

..hlC 



fjc -Qo/- jfjt/ho 7- /j t/d</ e yti/fj. rtk f*/ 

_///7 /lo/f - fkjt ekX/. _ 

Mthc/t. /v#/,* / />*/* &?• _ 

///- 0fj' fo^r c*/f 

] [ // /'A/^ oJz/. 


' fa-Aj 4s 3& - sASf*SA<Jsjrp?/ 7osT/i. rtyA | | 

* Jvi'hki o■«( •/ftfA/? « J*«t( V</ 7tj7. 




~ D*e A 7 jAL 


tf/it - Qrra o 7 /Q /> t(/er /«/«4 

— tfflA'' £-f< £ A* r S ’»X/<K sf 0 /yo// /Z/77. Al'dk / <X */,Sj6f A 
//" uU A}J/1 


f Coofr " /n*t/A* /'7'dA - t>r/o~f yt,e,/ . XV ro/it^,//^ . 

- 7 :^ x| 


00*/ ~ cX<X /^*d- / XX X fo*/^rv/€, $t» V AaqU L/4k sZe s/k+ffj oJ, ^f 


X- r»~//See «/^V <?/**/ A./To-t/. 


’ 006 - 


/k 0/Q ' C*r d ^ <se^°- 

(y^ese „e „,*/ ,/*>. /a * 0 / fayy / M^„v /2vvv yXX 

gJ. jfM. '/. //VO s/e ^AfA^Aeel. 

- ?a A r w> r ^ 

//CO/2- ✓*</ /i/seJ -do*'/ 7 aoO>. 


(o*-^ c*//j - 


//(?<,•***£ Tct/ /*■ r^A AaAA. 
























FEDERAL BUREAU OF INVESTIGATION 
FOI/PA 

DELETED PAGE INFORMATION SHEET 
FOI/PA# 1353814-0 

Total Deleted Page(s) = 5 
Page 14 ~ Duplicate; 

Page 15 ~ Duplicate; 

Page 16 ~ Duplicate; 

Page 17 ~ Duplicate; 

Page 36 ~ Duplicate; 


XXXXXXXXXXXXXXXXXXXXXXXX 
X Deleted Page(s) X 
X No Duplication Fee X 
X For this Page X 
XXXXXXXXXXXXXXXXXXXXXXXX 



ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 04-04-2D19 BY C66W46B11 HSICG 


n 


PD-340 (Rev. 4-11-03) 


File Number I 




FleK Office Acquiring Evidence -X N - ^ - 

Serial # of Originating Document 
Date Received /2-^/zof£ 


-73 


From 


(Name of Conlribulor/lntcrviewcc) 


b3 

b7E 


r \ 


(Address) 


(City and Stale) 


By I 


To Be Returned □ Yes No 

Receipt Given D Yes ,B^No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes EKNo 

Federal Taxpayer Information (FTI) 

□ Yes -O'No 


\Mt> 


b6 

b7C 


Reference: 


(Communication Enclosing Material) 


Description: ^ Original notes re interview of 




HRC-1761 






ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-30-2016 BY J76J18T80 NSICC 


S/zs&fUa __ 

- 1 - C^rr*=,~ 

_—.__ —:_l - =. ■ . 


Cl). 


Jgfg^ rv p^g~-^yv A7 ATrk./ E^Ce-^l ~7~ t4g ^ ^ «a-__ 

—Z*=>l5>. <- Ofc+ CiAi5-^>»J CJr& C^, 

__ r->^— _co/rH.05El_ 

_ tAXA/ jlSA 'Z &iH _jf? _4—>f C- _ 

. uj I (Ite^ _ u4_ - S_vj^f- c_ 

Hb/^hcX ( s-hLt__rt. _ 

» rr g . _v_o.i4^u._~rH € V x3t-\ ^i-4 z q/*^ _ 

■» pL^X_ t>-c<sr~ T ff fE ~Q €>S^L-S ._ 

_C=p _ sr^Ai h-Ltt^Gsi. ._^__‘^^_i/sii-^»;(_ 

—fcJo.f^Lc;_ cl>(5l- -65IA, - g5c J pg^£>_-A^lC^rr-'^ r 


jLXj\ljpe^^ , i£>l.i'iL6ri AT^_X23.S>_r?_ .(SO. _ 6o\5r^i4-o CJc_Ot-ij'_ 

_|.(4.^>lt£> _.cZ^tA./sJ-____ 

CL3 t —1 St*M^._SDO. —Ac Cl~Qg—- 

-T^lT O 1 ^ -f /O-^—LQi—23 . _ 

i._ 

—‘sssgug* 7 —r5*-.g.iA- - - 










--jacW'- 


a* 


1 


II 


007°^ .oabj__fcLS_b7C 

__ 

:!_4^j2*seff^_cfe_3=£ > /4_ ._ 

2_^Ap\_C)St=-MA?^ .a^..r^..A!^g? ..R^si..^ p_ ^^ c^dkjr_ 

_Z^^r_rt3t6y._ JT^rc^J_tk^_'rfew._ 

° _.aKrtT ^r ^^ tcv^r-^ ^ ^a,l ~^F^. A-*-At^> Ajpf~_ 

Q>^_A_^5gM^— - _^Jj5T _ 

—(^o oen-g -/-Hg^4£Ar-^ *aok<-^ -^ie-^_SMikc£>_ 

_sxj.|_ [ iL£^JAt(-1 -J~oc^x> J<r£ _ 

-Eco-ac>_4-_- 

-C<_Xr> A^fcS ~ _/vi-o__ _ 

I^JCX^-LJ^r^ge__ 

-tk&cx^/M.ff:. ^ -Mo -Jr?iOK4^: XZ^£it..O^L _ 

ifr*^ <4^ _ , cocb_. __ 

NoT^*^V)S^_ 0_^Q^ l4^S-^M(5t-OfrJ-SaS?5u6^_ .Oicot>,_^cs_^_ 

| sS»j/_C-iM^-_, - o«aecfecL,_£* c 

_ - _ __ 








,- £pa __ 

_' i «^-i -^3^*r^-g^£^f>-l. ~ZxW^>^~l _'rg^Q ^r (jb rtWTV^_ 

____ 


__ Lt^C^l^^„®o^_pEj-X._c>^l...£_£*^ to>A _G>.€ri.. _ 

■c?%J\i€ OAMt_--gssC 

--€=^-A LSa- JiSfr -A<^V»Vj< 1-W^tr $ZZez*K - 


W^JZ^r- S=3a=*A_^<T^W^-<3S£S!*^L- 


pgo^tss to e^fb^^=> fncs:*s_ 

_ jS^>__ rJ^D.O_£?U3CS>_ o^: _ 

fGu--S^=c>£^ r \ I -r 

. _Cfe_ All-- -6uAitb_(3-Ot-.-fi3J-j___ 

_Cl5X- _ 

_J^„G?>Ti_ia^i ~rter .iMls&ni|_ 

L^/.mJ^_\j / A_^aaAu___-^ | | _c^6£»_q?^ [t-j_ O— _ 

-3Z3u^^<j2&z^^l=C^ _p^ _fg^cJecrL _ 

.^ ._ -a 




_1r>Or-L4_ 


_! _e?^^e—X^A=oA_ 



__K*^ -t?eoie^±_ 4-TDu?..fc.,uS&^)_ 

|-1 ^ "***&*? jL*^- 

_<&_ 1 Ir? i^-pcgi^t^_lC_/2^no_crt_^i_cc*L__ __* _ 

_L^x>rhor--l <=> ^ Q pAJ^c^ggL_ 

_jUDo-ti- _~ r ? '- % C-. <M i:_P^- r -£rfe!_-_ 

_ 1 Ln~^r~^_AJSAy ^ _~t^ ~a> ^^S E1aI )Fl. cz^r-^£=*Jj\ i.cJb»._ P^QjrC3 Sr~~~~> _ 

_: jp..T5^>__ 

_■_! g^UJW. JVro^JsL. 

_cj^M^xjo- \4otA--TZ_._ /h-L. 7!£n t-s- -S^£^g^foio^-^a^t=r^ 

_C=?-g3».ix-^.__ut f = C&Z — - 

__: Z&&?. ^0-^>_ -??/c,_._ -to frt££-<Z»~L Sfo&r-'Z- - 

_^^juj5fe_Lo*»6caS^ -\ju|_<S*M»iXx p^euCXiofe _72- X>£>_._ 

._/ r~i r ^T _O/ tkjmq^Y •_ 

_L* _ 

_ 1- use* _ 1! __ 


m&-^&UdiG- 


- TJTZsznk-0£p^£>+Xfcz _ 

_ tZ£E^J*crti=Z> 4VfrpjlZ-S._ 

_H_ A^T f">-f^=i^-4- j&SL _jfojLt^;_ 

_~ ^).-e^_' _/wksJi_^vS__ 


HRC-1768 











__ -~^=*M. t-ESJiu__V-0(^CUTL 

_,__iLiosS&i^id._ t _c=>*raivj6r~ 

Ac£j££s&,. 



* " rp f=T-^ (__'p^t s Sr^c^i __J*>£yc»~SC> _-<£>-U-.- 

• ta^ ptesrW^_Q^~~~ •=» Aio rca^4, o^-Sc^^i_ 

£J©^_T>^:k_t2fc*rLJ- T^LiCJ^c^i^t T^A^igL _ 

' A Hl^i ^ T2-^p5=> --^__ T >oS -~^ ^xuAiC— CAaa£ *-a^ >_.*J _ . 


^ r^>A^M 'Z-r-f- ■ poL-L JlL 


i_M6L 


MUCH* 












_.'OAr^_ T^SfO^L l _ 

SA^5 _dfiC^!±WO*& *. ^G£* pL03J&4_ J&O^dekL._ 

J^Ktl^O-ZU- .®^66., 'UU^lct'- s£ 

_/sxC5t_ _^J^f-fZM*-LC> - _ 


^_J±Cc&^JFb±j_. LiO-l. A^rS^fe,-_ 

_=_•&*}... IEP_ PE(.^^2s^ _p^AcJn<32_tfO£^_bO=»2il, 

-^>^JUt^^-J-—5 U— ^/JiAu-A^iiUoJ^.- 4=<te»A^ .TlSsU-lS^-_ 




p-i^a^-v- Afc» v #Xx^ 

h-^*s&^-ekc<&j&£> _=r*_<a 


1_^»C3S»5. 


Jinfus 


'Cxscrki 


m 5^ \jjo4tf-. 


HRC-1770 












HRC-1771 







r 


_ X>J.&3£±! . - 7 __^arjvti _ 

I if 

_i •Z-yZ ox'A & M-n_-no C tST >A^.^ rz^4^fXhc^.. >/ fosku. 

_— T^n-r^ T^e^rH pg^l T7~~> 0!s&H=>J& _ 

_g3»~* ^g-____ 

_ ~~ __!_!._^_P-4 

-too T»^JMSO-3S>V^ __ 

-n ..fc>_pE.,Kx4^^>----- 

-z _'p^_pg^.rr=*£^>..rrD-_i^SL —- 

_Jd5b_e?5£^^x. Ccp>J _ 

_3X>^^_rc^_^75e rHu^b'TZ} -f^TT^_ 

_-•_ 

- ^X t=._QspJ_-J-*^S=sfe^_itoo_ 

_AslO-Gdp4_CDP^_il^5^—c^Za^_T>ferA -*S£=rT_^1_ 


_= -f^t>_^gM40.Q^a- mj f ^I>*S>_<e>.J_ Ip^cCiSS^_ 


b6 

-b7C 


_^C^Jc__/tri,_T 


__ 

_^_T_X3C_.-,-^. yf^^firtkXZ*-J^j. _ 

_ ~^L _ ^/S—. -T^__QD*--t.fiS^r l AA— 

=05^ 3^ t=l Qv^/T^oW Bl^-- 

_uJouCcx ^'o/ i^-- y^^o^£=>~ — 

_X^z^ik rj£j- *=0 -MoT _t_~c 

_ —uo-^3p&L^C^-<=>-^- ^g^ivsj4g^ /f£A3eJ*<^. _ 

--_/M^J-A*-L_ .&ol S7 - posfc- tfvLft^A^- - 

- -M&&Z _C-^2fqp_ - LMh(j£-j£l __ 

_enA— 1 ^^XLS^^^fkPffU^B:-\xpf^ JflAJL. -UUthogz- 'XZXfJzLtjr-- _ 

_- T?a_^70^,_ zzuoe—Z&JjdZjd* _ 


-_—_.--V_ A>»S£^ -<=>e_ c^e^_*^? 

T^t>4-4- UJ/nvCV (WliMc^c 

r-V^"-O---'^^v\A00t>- 


fefc—b4(3^"_p^U_C<C)M.U— T2Sr- _VU\J^> iMfy 

Mo 1 Z=^£-Atj._■E^. " '^cjSA^V-'^.T t* 


HRC-1772 





__ 

_ l^rA/CX <L^> _l£i_ - yt^S^f^ZL. _ 

_n_-_1‘_Wto- 


- CpuCJ*-*— 




-PZI^e^^vP:^ -' r *r?—_TS^1__- - 

- 

— X5c«fefe_ .^OO CC^E^EZX-_ 

_L^c=&.__x^»_ (bPckh^^>- _ 

_iAWJtopC^--OWj^ . ~Q a O»s^_ U^^dzL^C., _ C^S^L.^jL 

. ■'(?.»■'' :V ■:■-■. ' r 


^^^L_^_rrtLk^f.- 


dpJ 4j._?.C>(.b- ( 





*e^Qv>^..fetX3o25!__ 

_-{P£-^-4 — -.MtSb.VWA^^-O^_ 

| - 

--_-~r^t^>-Ni-4—/-Ki^Zv^Et ~n^u^r^ - 

-^ A-— r^^pp^se#Jt/^o.s4- 

-^^sf -2 g^ -F^-4 -Scp^P J-C^LSZhc**-^-? - 

___ 

-rr Mo_ AAAv^fci _-t2gxp<-i3rfP/-M__ 


13S:soj^J-vgo^— _ 

-U.A_^_ hk-MC5t_Jp<Zai\.X^._-^_ . /1 /j AS2e Jz_ 

- *"'* ^P^k>-^_4-^^__-qaaAi i ^ / 4^ft=i~ £fC_POiC^c^- _. 

: f^j&AAa/SSi-JAC_ TZSaj i>Suo^b-Oa o^cLrnfc_c^3'_^^____ 

. A^ jK ._ 

_£^.fei.(oO- .tFcR— Wo^L CJ^J^t_ _P 


- uS4^r~ 


T^&to_jas»?^ t^nj. 43 . 


~nJr=r~&c& njessf- 


HRC-1773 












— . fisvj ^<I^rsg,t M-/WJ3 AA' ^-fe. ! f~4f^ r—JiAA^f ^ 

-*o _S*E^_JrL_ 


-T7-r-i 


- .1 

u 



| pAWQg- r-J o (^ A_»£5>v) VN£ga> iM.V’-g^NJ^r . 

I h rO_ _0 J .L^(.^Mg^H&_A5?£xi_U^6^iL 

_ 


b6 

b7C 


b6 

b7C 





I 


ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 04-04-2019 BY C66W46B11 NSICG 


Ha 

f' 


R>-340 (Rev. 4-1 

File Number 


SOT. 


b3 

b?B 


Field Office Acquiring Evidence 




Serial # of Originatii^i Document_ 

Date Received t 3l2&IZQ\L 
From 


-lif 


(Name of Conlribulor/ltucrvicwee) 


(Address) 




To Be Returned O Yes 

Receipt Given D Yes 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes 

Federal Taxpayer Information (FT1) 

□ Yes 



m 


ErKAH,- 


b6 

b7C 


Reference: 


(Communication Enclosing Material) 


Description: Original notes re interview of 


HRC-1775 



1 

1 


ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-30-2016 BY J76J18T80 NSICG 

, skelfriu 

- (W M I , S '.JoA 

vVfce£>. 

_ _ r^iufA i__ 

i 1 1 b6 



OJa&s'a c--fev l reiX*j Q fiv-, 





<h 


o/P^N 


ug . <3d^/er jj 


V-/ 

Egkk_ < s?€-Ctx-rt CiX^-G^- rv~\ r __ 

?eA?€^ d-^> <v. rePe^e^c-^. QoVif 1 4-€xU^.i^( 


1 ^’g-CXA^tV^ CCr— C^0CX^~ *3^ 

> V>^L At V* l c -^-o w> yA'ft" lc>|) j-pp )V £o)j , 

LB**- -yg|- U-vlfl ) ^- ct t ^C>A.<g/U^> I .C.O*—V. ^ VtO 

I > tV' 


1 

e 

1 !t)^K <Loe» 1 

!' 

1 l/X^-V 


GCeC&J 


l+;A GlccC^ 



























xoK 


i C ofWU 


\<>" 


-^M . VgJ?^ t^-ojk/^i d !> 

' z' ^ oJ^-^ to^~&~ 



HRC-1777 





















i ev ^— c 






^>-«e>v^ \<viao u3U^"e_ s 



e> 40-^!i v/;y^c 


<A^ 




















Pell l'\ uJs<L- 4tA^'^vcJ v 


9 CM\ . •'~<3c- 1 J~- Dv/t^v . ~Po IplfP? . i»y^ 




ItJ 






nV>I^€a^- Vt5 \'(Vje^Arl ^ ^ 


19 


-5 5a^JI\ c^- 
















































* O /lOA^a-T! 1 —^ ~ vo j^-Vs-o._ 


G-/\ (A-y 


k <^i'ovU.4" u>^~ ^ / '-eAx-~> x -^_ 




■ ckI- 































i« /Vvv_ 


72J CO——*v— ^Ci of 


LA-^ti/H 


- to . 


; *** T~q\^~ Vo yvu^OftJ^^-v 4 -+ 


Vi A- g Cv*-^-<a_^ _ 4** ? ''^ ^>\’ i -dlO 
















ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 04-23-2019 BY C66W46B11 HSICG 


( 


f \ 


PD-340 (Rev. 4-i 1-03), 
File Number 


n^> 


Field Office Acquiring Evidence V)-. \ fX 

Serial U of Originating Document_ 

Date Received /(o 

From 


- Jo rr&L. 


- 


b3 

b7E 


(Name of Comribuior/lnicrvicwcc) 


(Address) 


(Cily and Slalc) 



To Be Returned □ Yes -ST No 

Recevpt Given □ Yes No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules ofCrirrunal Procedure 

□ Yes O' No 

Federal Taxpayer Information (FTI) 

□ Yes J2 No 





b6 

b7C 


Reference: 


(Communication Enclosing Maierial) 


Description: Original notes re interview of 

~ Ba. rfax _ 


I 

i 


HRC-1789 




ALL iBI IBSOt8iK?ICW CONTAINED 

HEREIN IS CHCLASSIFIED 

DATS 11-3C-2Q16 BY J76J18T80 NSICG 


btri&W 


DOS 46otu - ^ - 3A. y rf. _■_ 

_ iQ^.<jS—&)<.CCL.d^.C _,_- 

_ t> ' h” bf-rrr t) \ ^ 0 $ -12- 

-- 

_Tvvld. ’ Hui_ 


-z^— 

pPEyWi 


,2 d-tf>uAn& 


MrACf - 1 /zLr-n^_twh-g-n Vf~ _r (L rr) t f W " )/| , 

_kiAd_/\o bATyvvilrlt j^ of _ £e,(sr fsf du-n r 


iI L ~ u J'ec. In shiLlccherr] -rWTlOcbfh 


ri^Kv^rob^r . I 

_ trmmi / phrn^ $ FnnrF ^iffi 



jgfi lArf 


0^10 f 


CrrrHutW ^ 


S&>hrvn . 


- g^j O^i p 1 ntfzilttd \^I ~ pp£ , 0 ■f fg/ 

home • 


M 

H^ -j-T) ^g-rsh^r m CADttt " ^ Mat 

_' Ajh a- p- \V VnIITwI^ b-vt \-v > •PA\ l lA v~/^ ~ h . _ 

_ Un d er J '&jh \a Jt f o o-f Sp efl'i-fi l___ 

. -H JB> j ?)g. o fv lik eu i (L 

\ Y\Q\ cfUr€ uQffUl^ V)iL\rf lotted (S jh€ P.IDtlA 1 • 
|^i (f€4tUL 


tml hyc clLI . erooj 


''I WUXI din \X&f,A 4 cr-yn f ha^> zfor\/Cr _ 

T>^ K fM 1 . iWn ci u>n nfl • _ 














> 

\ 

(i\bv -\ni\ffA 'hr. 


1 

. X&UX. 

^ adr a. \o\ O -f JifrTfct' 



sir - - dtL'K \ 

"fh'KI -p^jrD r v 



^o +■ -Vrfr or CM . 


^ 0 ip repcVb 


#h'll rCCM 1 teTWfflfrhiVTJ 


Not SH jl f - knn d^nt- 1n<u/€ rej pm Mf 4^^ itido |. 


i . 

iAlruJ<l htLi^ \u <J 4 d Sfertte jcY \aru.\d-nV 




Pi^n^- -k(\<L ui| anvj r rmf ^ ,I>o4 —n , ...._.^. c^ 1 


4» 1 l£M - no n( fr--f s^rrC'r- 


-:-- 

-,- - -- — —= 

?prv\(\.r\ Vila - bo-}- -Skt-e. Mhie-m ! Cas^&A ■ 


4l>r Blfir l " - tnojjjke |yidU k so fan) ihtU&t&n 


*'o ^ k^0K3i€dla^ o-f CWpcrb? cm vO^ - 



"- 



/Jtmh r^rOt^mbf?r Uh^n \. 

1 

v -— » •*'-• — ~v /^7M 

kotfJ K-e had A. j?£dVO£l ^ni6/ 1 / ' 


l^itlnt kooJ BrojuI -ftr Luring 


1 J 1 

Himb y-jm mbfs i-P ft^-C bd^ (X ~bdS GxY)l l\ 


Ad/lfh.m-) . 




\4t>f a& *- n.&vL\-e » - , 

cuOard of i^ub-f bem4 N’pYbt'^f cj4c.^ 


&r%,|,. J 


HRC-1791 













^Qv|_tpc\^— QXM^ — y° w fcM<n—£) ncL- 

JrL(tcq-I.Qjj_L- 

—/hcc'SOT^rl—: 

frnu 1 3 " A ^-L^-/tJU.- ) -b.\^i_ QjJ^. _Wl^rC_®rQdU_(- 

—cUu^-nj—th^c—- 






?VI{\ Ytcf\0.nt ' when v^vu Vu>^ a_ D 06 


•+■ ^iV - ‘Xu^V wci^^ her "W ffluvV 1 

If for pcr^oridiJC «Y\e^6-£je$-^ 


de-nt h:l<lU_ discus oT 


W K 


T6/JV 




£orn ewhal : / Wud -c Wh dh- is)isnl~ a t-fcflgrc 

_ . h o± _^r^_hxj„go.E^^/^_l^ — mrL-nppoipL.. 


JjfdlDjL- 
I . vxJ-i i fi v 


\mfinry2L^a±L 


£y^c Str. / M^ui \>3su(d_ki^Le_ 



From: 

Sent 

To: 

Cc: 

Subject 

Attachments: 


Lee, Purcell N 

Tuesday, March 17, 2009 1:35 PM 

Wagganer, Kevin L; Bentel, John A; Scott, Andrew C 

Duncan, Bruce E 

Secretary Residential Installation Hotwash 
Secretary Residential Installation Hotwash.docx 


Attached is the agenda/talking points for the hot wash. 



Secretary Residential Installation Hotwash 


1. Equipment location: 

a. Unclassified Partner System: 

i. Server: Basement Telephone Closet 

ii. Telephone Set: Various rooms 


b. Cl?.ssifi$4>'a.^: _ 

-I. 


c. 


Btxsr: ”«*=:* 


2. Status of Installation : __ 

a. Unclassified PartFiRtTsi^vaie”J^a4rtijU’X*«npleted. 

b. Classified STE/Faa? 'GcmpIcESk " 

c. Classified Red Switch: Completed 

d. Unclassified Ops Drop: Verizon is still working to finalize path. 

e. CMS Classified Video: Declined 

f. CMS Classified Voice: Declined 


3. Issues: 

a. T1 Telephone Services were not available upon arrival 

b. Analog lines (2) for the Partner system was not ordered. 

c. Red Switch Technicians arrived 2 days later than scheduled. 

d. SDS Data Cable was left in Washington 

e. Former President’s wireless headset was disconnected 

f. Secretary Clinton’s headset noise cancelling was not selected 

g. Spefd Dial for Secretary Clinton Unclassified telephone was not 

h. SeSSK&fcy’s'demon’s business lines were not set up in a “Hunt Group” 





From: "Hanley, Monica R" <SBUSTATE/SES/RECIPIENTS/HANLEYMR> 

Sent: 8/30/2011 5:32:36 PM +00:00 

To: 'huma@clintonemail.com'; "Abedin, Huma" <AbedinH@state.gov> 

Subject: HRC blackberry 


John bental (202-647-4656) just called me abt getting hrc a new blackberry for the paris trip. He said that he heard that 
the chapp server is down. He said that the she spoke to the comm guy directly abt it this morning. 


It looks like she's receiving email on her ipad Does she want a state berry for the trip? They wld like to know this 
afternoon so that they can set up 


I told him that I wasn’t sure and 


\ - rJV_ 

'J&KQfi 



-'L■ - u -'-'i'- 


PR_RIM_INTERNET_MESS | 

AGEJD: .state.sou> 

PR_RIM_PAGER_TX_FLAG: true 


PR_RIM_MSG_STATUS: 1 

PR_RIM_MSG_ON_DEVICE true 
_3_6: 

m $&/l_MSG_REF_ID: -1561860114 

?||,;RtM_MSG_FOLDERJD: -6 


PR_RIM_MESSAGE_SUBMI 
SSION ID: 
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From: 

Sent: 

To: 

Subject: 


"Hanley, Monica R" <SBUSTATE/SES/RECIPIENTS/HANLEYMR> 
8/30/2011 10:09:28 PM +00:00 
"Abedin, Huma" <AbedinH@state.gov> 

Re: S berry 


Do you want a different address? 


— Original Message- 

From: Abedin, Huma 

Sent: Tuesday, August 30, 2011 05:19 PM 
To: Hanley, Monica R 
Subject: Re: S berry 

That can't be it. 

-Original Message- 

From: Hanley, Monica R 

Sent: Tuesday, August 30, 2011 04:19 PM 

To. Abedin, Huma 

Subject: Fw: S berry 

SSHRC@state.gov 

Original Message — 

From: Bentel, John A 

Sent: Tuesday, August 30, 2011 04:15 PM 
To: Hanley, Monica R 
Subject: RE: S berry 

Monica: We actually have an account previously set up: SSHRC@state gov. There are some old emails but none 
since Jan '11 - we could get rid of them. 

You should be aware that any email would go through the Department's infrastructure and subject to FOIA searches. 

Let me know if any questions and what you would like us to do. 

Thanks! 

John 

SBU 

This email is UNCLASSIFIED 

—Original Message— 

From: Hanley, Monica R 
Sent: Tuesday, August 30, 2011 3:59 PM 
To: Bentel, John A 
Subject: S berry 

Do you know what her email address would be on a state dept berry? 
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AGEJD: state sbu> 

PR_RIM_PAGER_TX_FLAG: true 

PR_RIM_MSG_STATUS: 1 
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PR_RIM_MSG_ON_DEVICE true 
_3_6: 

PR_RIM_MSG_REF_ID: -1805720130 

PR_RIM_MSG_FOLDER_ID: -6 


PR_RIM_MESSAGE_SUBMI 
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ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 12-01-2016 BY J76J18T80 HSICG 


3 June Meeting - Proposed Agenda 


Here is a proposed agenda, but I defer to the host to change or delete any portion that it feels is 


unnecessary or inappropriate 


Introduction and Background 

• Background of the Principals, ! 

• Caveats -Not a USG Project; no systems, sources, methods, means, personnel, data, or 
any other resources of the USG were employed, only commercial off the shelf resources, 
both known and unknown to the principals. 

• Background of Project as authorized by customer JW. 

• The Phase I Scope and Order of Magnitude 

I. Results of Phase I - Was SB server or computer entered and if so, did the data 
move offshore? 

| 

1. SB Server was entered directly and data was moved to Guccifer server or computer. 

2. SB server contents was then moved from Guccifer server to a second IP nearby. 

3. Not clear who this second server is owned by, but data was definitely moved. 

4. Data includes memos from SB to HRC and found on SB server. 

5. the secondary source has over 37,000 files on it, and many (over 200) trace to SB. Of 
these, 25 or so were traced and recovered, all of which show positive indications as 
having been authored by SB, sent to HRC, and recovered. 

6. The discussion within these memos suggest SITREPs and alleged Intel Assessments using 
HUMINT on the ground in Libya. 

II. Results of Phase II - Was HRC attacked directly or indirectly? 

1. Of the 37,000 files, we would need to open each and trace back the content to the 
original server. The Phase I assignment did not include a scope of this magnitude. 

2. However, Key word searching of the spreadsheet show many references to HRC and 
other symbols that may be files that came directly from the HRC server. It is unknown 
at this time whether there was a direct, pernicious attack and wholesale exfiltration, 
based upon the evidence assembled to date. 

3. One file was recovered but the providence is not clear. This file has attributes that are 
similar to other Libyan-based SITREPS, that were found. The time, topic, context, 
names, and background all seem to align with these suspected attacks. However, much 
additional research is needed to trace this document to its original source. 

4. The document did not come from SB or was not found among files that came from his 
computer. It did bare, according to one source, signatures of the IP for the HRC server 
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'atfd is suspected to have come from her computer or at least a computer linked to an IP 
f; ‘ij.k'lress that ties to where the server was in 2009. 

,5f*'' V?i£§iis document is deemed to be genuine, authentic and relevant to the issues here, it 
1 represents a major loss of grave concerns. 


III. Results of Phase I - What was the possible motive of SB? Was it to create a quid 
pro qua? 


1. Rogue National Judgment Recovery Work. 

2. Work with the Libyan Opposition Government 

3. Work with the new foreign minister as a back channel 


IV. ' Way Forward 

1. A number of possible ways to obtain more specific evidence as to SB motive and to 
check the veracity of the Rogue National Recovery Program connection to SB and 
others. 

2. Recover all 37,000 files under the International Bulk Data Silo Procurement Program. 
! Could be done by the host, or could be contracted or could be part of Phase II. 

Many different options on where, how and when to select the data and subject to 
i analysis. 

3. Check the providence of the key document and try to trace it back to the original 
source. 

Questions or Comments 




Phone call 


Gmail 


l- Gmail 


COMPOSE 



Inbox 
Starred 
Important 
Sent Mail 
Drafts i 
Circles j 

Deleted Messages 
Notes ■ 
Personal 
Saved 
Travel | 

More 1 


Please send as we discussed. Thank you and look forward to meeting yo 


Hey j I couldn't download the file via the link sent in a separate email. .. 
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Thanks -1 was able to download all the files. On Thu, Jun 2,2016 ail0:17 Aj;. 


5 


•'.'.V <:• 

. • b?C- 


A somewhat urgent update: 



l in will sign you into 
Hangouts across Google 
Learn more 


For the past six weeks when the hypothesis of the SB portion of the report was 
over the dates of the seminal events, the key name of the person, and the con 
with any evidence tending to support the timeline. 

I finally recalled the way to track this down much to my relief because for a whi 
recollections on this issue and confusing facts. Indeed, I was not. Below are s 
ras a means tn determine whether the hypothesis has any merit at all. 



Friday, January 20, 2012 1145 • 

Friday, January 20, 2012 1150 jSgj£_- 
Monday, January 16, 2012 1015/sM 
Monday, January 16, 2012 lOTSAtVrve 
Saturday, January 07, 2012 1103 A M From 
Thursday, January 26, 2012 1111 A 

vish, I can up date the draft memo t n reflect context of this OVjbr the weel 
ave discovered: 
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Revert to the old chat 


I will highlight the relevant section in Yellow so that it fits the story line and coni 

Let me know if this is something you wish, or if you just want an oral brief as a 
should be done at some point, only because it is really important data and has 
have been mystified about since I was engaged on this matter. 


Take me to Inbox 


1 of 1 


i 
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ECUTIVE SUMMARY OF RESEARCH FINDINGS 


to the above, the Phase I Study resulted in some other detailed findings that are best 
d below: 


1. The computer of Sidney Blumenthal was positively identified as hosting 
many emails and attachments originating from Hillary Clinton’s server and 
others from the Clinton Foundation. In Phase I, we recovered at least 20 
memos from Mr. Blumenthal to Mrs. Clinton that contained Situation 
Reports (SITREPS) allegedly based upon intelligence sources in Libya. 

2. Mr. Blumenthal’s server was successfully attacked by Marcel Lazar Lehel, 


originally from Bucharest, who is also known as Guccifer or 


3. 





ume 


While one spreadsheet shows that «ver 37,000 files were foui^^^a closed 
encrypted and password protected site of someone other than Guccifer , only 
a full analysis of the spreadsheet will reveal all of the files traced back to 
Mrs. Clinton’s server directly, or to that of Mr. Blumenthal. These files were 
traced to a computer that was using an application to access the Peer-to-Peer 
networks. The computer was traced to IP address 84.232.210.154, which 
points to Bucharest, Romania. 


4. One search revealed that data that originated from Mr. Blumenthal’s server 
was transferred to the computer at 84.232.210.154 on July 5 th 2014 at 07:12 
(Bucharest Time), and yielded many references to “HRC” within the 
spreadsheet. This would suggest that the content of the computer traced to IP 
84.232.210.154, was not Guccifer , but someone else who accessed his server. 
The reason is that this “migration” occurred long after Guccifer was 
identified, arrested, and incarcerated in Romania. Several possible 
explanations exist: 

(a) Guccifer had a co-conspirator that continued to operate the 

collection from various sources as a “get out of jail free card”; 

i 

(b) The computer doing this collecting did belong to Guccifer , and he 
allowed it to run long after he was arrested. This scenario seems 
itftlikely for a number of technical reasons. 

(c) This computer belongs to a foreign service or someone else who 
attacked the Guccifer server and transferred the data to computer 
84.232.210.154. 

5. Notwithstanding the above, data from both the Blumenthal computer and 
the Clinton email server migrated to Guccifer , and then to a computer tied to 
IP 84.232.210.154, both of which were located outside of the United States 
and outside of the control of the US Intelligence Community. Assuming 
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either contained overtly classified data or retrospectively classified data, this 
is considered a major Counterintelligence concern and of interest to the 
Community. 



entered the Blumenthal computer several times, first through 


7. 


s AOL account. It is not clear whether Guccifer targeted 
Blumenthal because he represented an opportunity of interest, or because a 
foreign service directed him to the account. Also, it is not clear whether the 
account was entered after he first entered the Clinton server or that of 
someone else on the Clinton domain server. 

During Phase II, much additional information can be 
sequence, timing and chronology of when the two servers in 
accessed and in what order and how many times. 



8. We found indications that Guccifer or person or persons acting on his behalf 
or persons impersonating Guccifer did a secondary penetration of Mrs. 
Clinton’s server on May 22, 2009, and other penetrations thereafter. 

9. We confirmed that Guccifer used an anonymous server located in Russia to 
conduct the penetration, and therefore, there is a high possibility that the 
Russian services that monitor these anonymous servers likewise have a copy. 


10. One file that was found on Mrs. Clinton’s server was not found on the 
Blumenthal server. This file represents a major loss to the Intelligence 
Community because it appears to be targeting data. The data is first in 
Russian and then converted to Arabic. It represents a list of targets that quite 
possibly was created by a Russian source, located or intercepted by our 
services, and transmitted to Mrs. Clinton by some unknown person. The file 
then left her server and was found in the Deep Web and Dark Web. 


11. The above cited file, an excel spreadsheet, we assess, would enjoy the highest 
level of classification if submitted to a person who has original classification 
authority. The file was found stripped of its collars (if they ever existed). If it 
is determined by the FBI that this file ever was overtly classified, it will serve 
as a potential “smoking gun document.” 

12. Guccifer penetrated a number of targets and we recovered over 37,000 files 
from a computer traced to IP 84.232.210.154 that he obtained. We created a 
mapping of those files as they appear in the Deep Web. lfe Shen tested the 
spreadsheet and the content behind the spreadsheet (ths S ;H)0 files) using 
key word fuzzy logic. We confirmed the following Bluni&iiMl memos were 
found on the Clinton Server and vice versa: 
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13. A complete copy of the Blumenthal memos sent to Mrs. Clinton were opened 
recovered in original format and deserves critical analysis by counsel. Most 
all were word documents and related to a number of issues. These can be 


provided to counsel as a means to substantiate the claims of Guccifer. 


14. We did not actually collect the content of Mrs. Clinton's server or the content 
of computer 84.232.210.154 at Phase I; we merely validated the major 
premise and hypothesis ti%i; ^ginating from either or both of the 
Clinton and Blumenthal attacked, directly or indirectly, and 

tai were moved outside to Guccifer, and then migrated to 

computer IP 84.232.210.131, and operated by unknown persons. 

Additional research is required to cull through the 37,000 files found to select 
those that pertain to Mrs. Clinton and which came directly from her server. 


15. We note that there are profound legal questions regarding Phase II because 
it is not clear what our obligations may be regarding recovery of potentially 
classified data that may or may not contain actual collars that overtly show 
the content was classified at the time they were sent to Mrs. Clinton; or 
emails and attachments that were retrospectively cJSsMfssd but were released 
in truncated form. Our recovery of such content be untruncated and 
in original condition. 


16. It is conceivable that one possible motive for Mr. Blumenthal’s decision to 
feed Mrs. Clinton the SITREP reports was to promote his group as a quality 
private intelligence group in Libya capable of obtaining detailed intelligence 
from various unnamed, disparate sources as to the thinking, actions, 
planning and intentions of key operators in the region. We do not opine on 
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the accuracy of the intelligence provided, only the tone and intent of the 
memos. Our assessment is that they are essentially, crafted as “shake and 
bake” intelligence assessments, done to promote a need by the Blumenthal 
group, and not to turnover information because of some legal or moral 
obligation. 

1 7. There is objective evidence to indicate t hat a person identified as _ 

telephone ! 

(circa. 10 January 2012) began to solicit Senior Intelligence Analysts with 
experience in repatriation of assets plundered by the Qaddafi family. This 
person began the solicitation process on approximately January 25 th 2012, 
claiming that he led was dealing with representatives of a “high level political 
types in the US within the State Department” and that he personally had 
high level contacts within the new Libyan Opposition Government that he 
would have a contract with to begin the repatriation process. 


_ has a rather cont roversial Ms*.? ry wit hin the US 

Intelligence Community, particularly at | " | His links m 

_(was one of the prime operatives in Libya. 

Notwithstanding his reputation in the US Intelligence Community, he was 
believed to have highly placed contacts within Libya which could have been 
mined for creation of a Rogue Nation Asset Recovery program, but for his 
limited technical and intelligence analyst resources. 


Phase II 

The proposed Phase II study includes: 

I 

1. Recovery and sorting of all Guccifer data on the server in Romania, to obtain 
all data that came from Mrs. Clinton’s server as well as Mr. Blumenthal’s 
server. 

2. Analyze all of the content of the computer IP 84.232.210.154, which appears 
to be different from the Guccifer server, although both apparently are 
located in the Bucharest, Romania area. 

3. Guccifer claims in recent reports that the secret server contains about 2 
Terabytes of data and represents all of his hacking efforts. We opine this 
statement is most likely accurate. The spreadsheet that we obtained which 
maps the secret server substantiates this claim, assuming a portion of it 
originated from the Guccifer server. 

4. The Clinton smoking gun data document needs to be mapped back to her 
server to make the clear connection which has not been satisfactorily 
established. 
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5. The IP address and email addresses of Mrs. Clinton and her f.©Heagnts who 
used this server need to be checked to determine whether any cocJsnt traced 
back to the server or the email address can be recovered! fro® tfcse I>£ep Web 
and the Dark Web sources to which we have access. 

6. The recovered data content needs to be date stamped and placed in a 
chronological arc to triangulate against the activities of Mrs. Clinton, 
particularly around the time when she was dealing with the Benghazi 
investigation. 

7. Counsel needs to determine from quality counsel with National Security 
experience and intelligence experts, the legal obligations by cleared persons 
to report and surrender data that may have overtly labeled classified data; or 
data that would objectively be considered classified had it been 
hypothetically subjected to a person possessing original classification 
authority. 


Executive Summary - Clinton Email Investigation 
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PlfA 



Introduction and Overview 

In an effort to determine whether there was evidence to indicate if a searcfi^otjt ie open ^aOurce 
spheres using mid-level recovery tools was fruitful, the customer requested that we begin our 
research on a limited basis, and provide results for Phase I only. The critical search terms are the 
email server MX codes, the headers or footers of the email server, or at a minimum, the domain 
server name which is fairly unique. 


The study, a worldwide search, was done in less than 30 days and the/cost was approximately 
$33,000j. The objective was to determine whether the server of Hillary/R. Clinton was directly or 
indirectly entered by outside sources, and the content found withiiyfhe Deep Web or the Dark 
Web. The client has not funded, nor authorized Phase II and Phas^/lII, a much deeper probe that 
is dependent upon the results of Phase I. 

The j^ient was advised that this research was pursuant Xo the attorney-chenj^'ftnvileged 
communications privilege and was intended for use iiibe/pendmg federal litigation involving 
the HtUary Clinton’s private email server. 

i 

The customer has agreed that the only exception to tfiis privilege^whiih would otherwise be 
reserved only to the client and its law firm) is fife disc^vaiy of any evidence whatsoever 
suggesting (directly, indirectly, overtly or otherwise) cl^aSmed data (without regard to whether 
we do not possess original classified# been absconded from the United States 

(wherever situated) and placed cp air%it^idc ,^f^r or device arid discovered by us. 

Should this have occurred, ^'is susp|^i : .$!*?ve occurred, we advised the client that we have 
legal obligations to ttm ov^r, tb^m^^aCio-Jkas well as the context of that information to the 
appropriate authorities^rfisj^j.pr) out/of the Intelligence Community, (e.g., Federal Law 
Enforcement within .^vision, as opposed to the National Security Division) of the 

FBI. The client haiatw^ic^ll^ agfeea to this single condition or exception to the privilege. 

.. ^ 


Durirg this phase, we were/not engaged to determine who accessed the server or where its 
contents ultimately landed of came to final rest. However, we were able to determine that: 




(a> Sidney Blumenmal’s sener wa«. directly hacked by Guccifer and Hillary Clinton’s server 
was indirectly attacked by Guccifer-, probably as a result of first hitting Mr. Blumcnthal’s 


server;: 


(b) The Blumcnthal content was transferred to a computer or server located south of 
Bucharest, Romania by Guccifer .; but we also found this content outside of his server or 
computer where it still remains to this day and is under another IP address. 

(c) We confirmed that it was possible the same person or persons acting on GncSifer's behalf 
or persons impersonating Guccifer did a secondary penetration of Mrs. ClrHtdri's server on 
May 22, 2009. 

(d) While the first “pop” where the Clinton/Blumcnthal content landed could have been at 
the Guccifer server, the place where we recovered the files containing this content was not 
the same server as where Guccifer hid the files, based upon our limited scans to date. The 
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reason is that this server IP address is continuing to collect to this day, and moreover, the 
date when the content was first seen after when Guccifer was apprehended and jailed in 
Romania. More clarification of this point is needed at Phase II as to who truly are the 
creator and owner of the server where we found this content and report it here. 


(e) We believe that the IP address where we found the files is 84.232.210.154, which is not a 

server, but is actually a computer using an application that accesses files on Peer-to-Peer 
localities. In essence, the computer is utilizing the Direct Connect P2P wMch 

disclosed the content of the computer to others on an open network known m tJse a?eep Web 
or Dark Web. Upon checking IP address 84.232.210.154, we recovered in at'3?,300 
files, of which at least 200 appear to have come from Mr. Blumenthal’s ©psajppfteiv CM ?hc 
200+, we verified the authenticity of a representative sample of over l;een 

documents authored by Mr. Blumcnthal, and sent to Mrs. Clinton, according to foe headers. 

(f) From a counter-intelligence perspective, if classified data is loeatefl on the above IP 
address, it represents a major problem for the National Security interests of the United 
States because by its very nature, data falling into the Dark Web from a computer means it 
is “open source” and therefore publicly available. In essence, if Jve found it, others have 
found it - nothing that we are doing in our trawling represents /^secret sauce” or source. 
Our tools used may be different or better from a forensic tilling perspective, but the 
resources are generally available. 

(g) There is subjective evidence suggesting that Mr. Blumcnthal and two ofoel's may have 
had a motive to present to Mrs. Clinton “tree-shaking” Intelligence SITJJEPs, hoping for a 
possible quid-pro-quo of sorts, but this is our unconfirmed, raw as^esiment. The possible 
deal may have included participation in the rogue national judgment recovery program for 
the Libyan Opposition Government, in exchange f<)r the St^k^Department Intelligence File 
that existed on the Qaddafi family asset seizure. 


(h) There is objec tive evide nceffo indicate 
telephone £ 


to solicit Senior Intelligence Analysts: 
the Qaddafi family. This persoiuhCgan ; 


jger ssa identified as_ 

~^\circa. 10 January 2012 ) began 


xpt?%Kc iS rftcafriation of assets plundered by 
le se*d%i©£ 'Hfliss on approximately January 




25 2012, claiming that he Ipd^vas danihg vvith fl?,p/e§gsf*4atives of a “high level political 
types in the US within thp4$fate Department” and that he personally had high level contacts 
within the pew t ibyjpr* Opposition Qovcmm cnt that he would have a contract with to begin 
the repairiSt^jpr^cess. | / lhas a rather contro versial histo ry within the US 

tpinity, particularly at| I His links to [ 

_was;one of foe prime operatives in Libya. Notwithstanding his reputation 

US Intelligence CommOnity, he was believed to have highly placed contacts within 
ya which could have bee a mined for creation of a Rogue Nation Asset Recovery program, 
but for his limited technical and intelligence analyst resources. 

(i) After the above scheme floundered, others representing the Libyan Opposition Coalition 
Government sought/p irc-start the contract that we believe Mr. Blumenthal and his 
colleagues had. Thiyrc-ignited effort occurred as recently as December 2015. 


in 


Searching the Deep Web and the Dark Web is not the same as conventional searching using a 
normal web browser. One not only must have a different tool, but also have the tool with the 
correct protocol to access a specific site. Often, to gain access to an IP address containing 
hidden files, such as what we see here, the protocol tool is uniquely different and it often takes 
considerable effort to find the correct, corresponding protocol tool so that one has complete and 
unfettered access. 
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Employment of these protocols is done by the owner of the site where the files are located in 
order to maintain the integrity and security of the site where the hidden files are located and to 
keep “prying eyes” out. 

Once the location of the files is identified, the next step in the process is gaining access to the 
site, obtaining, collecting and acquiring all of the files, and downloading them to a safe and 
secure environment. 


In this case, the computer of Sidney Blumenthal was positively identified as the host of many 
documents sent to the server of Hillary Clinton and others from the Clinton Foundation. Mr. 
Blumenthal’s server was successfully attacked by Marcel Lazar Lehel, alsp known as Guccifer or 
“Small Fume,” originally from Bucharest While one spreadsheet shows that over 37,000 files 
were found, only a full analysis of the spreadsheet will reveal all of tt>e files traced back to Mrs. 
Clinton’s server directly, or to that of Mr Blumenthal 1 

It was believed initially, that the content was the hidden Gufcifer server that he kep^alfd 
maintained in secret, or allowed to continue to run and collect/aata frbm various source<whilst 
he was incarcerated. However, this assessment seems bom farfetched and npK'particularly 
logical. More likely, the content we discovered at the IP/address cited abpydis an unknown 
person that originally collected some of the Blunienthal/Clinton conlam front the Guccifer 
server, and then moved it to where we located it. If:A» assessmem^correct, it is particularly 
damning, because it means that if the content contAns natipn^Tsecurity information, it has 
escaped the first landing spot, and has migrated to aiymnknowliaestmati on. 

We assess that it is possible Guccifer entereMh^Blumentfi^; compute s.i;veral times, first 
through' Blumenthal’s AOL account It iwj/T clear whether Guccifer targeted Blumenthal 
because he represented an opportunity oHmerest, or because a foreign service directed him to 
the account. Also, it is not clear>tfethet/the account was entered after he first entered the 
Clinton server or that %£ sonreorfe else on the Clinton domain server. During Phase II, much 
additional information ca^be obtained m the sequence, timing and chronology of when the two 
servers in question wgptfaccessed md/n what order and how many times. 

What is knpwm is that Guccifer is a wholesale, sociopathic hacker who conducts pernicious 
attacks^^t for reasons of ideology or retaliation - rather he does it for money and to sell data to 
th£>ighest bidder. As aresulyne was indicted and jailed in Romania and at the behest of the US 
Justice Departm^j: aad the EBI, extradited to the United States where he was also charged and 
where he recentbl^ied gui}ty. While Guccifer was tagged for extradition by the FBI before the 
Clinton email scandal erupted into the public domain, it is curious that his transfer comes exactly 
at the time when the F^f most needs him, when they are finalizing their prosecutive memo to the 
Justice Department. 


Guccifer hopscotcKed among the accounts of victims such ai 
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1 For additional information on files extracted from the server of Sidney Blumenthal by "Guccifer only", and found on a Password Protected, 
encrypted server of "Guccifer" In Bucharest, Romania, please see Attachment #3 Blumenthal Server Traced to Bucharest First Attack 
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Along the way, Guccifer gathe red the cell phone numbers o 
the private e-mail addresses foi 


By breaching Blumenthal’s account, Guccifer was able to access files that go back to at least 
2005 involving an array of Washington insiders, including political operatives, journalists, and 
government officials. Based on screen grabs made by Guccifer, he specifically zeroed in on 
Blumenthal’s emails to and from Hillary Clinton, sorting Blumenthal’s account so as to single 
out all e-mail sent to Clinton. 


Additionally, Guccifer further sorted the mail so that he could download ajl Word files attached 
to e-mails sent to Clinton, as well as the emails, .pdf documents as well asrjar and .zip files. We 
created a spreadsheet of the entire drive of where the Blumenthal as well as the Clinton files 
landed, a private server in Bucharest, and identified nearly 37,000 records, not all of which came 
from the Blumenthal/Clinton Server, but represent the fruits of the Gu/cifer’s labors over time 


Meaning, this is the location where his successful hacking efforts were stored, and fi 
direct and indirect attacks upon Mrs Clinton’s email server were found This IP address 
identified, tested and found to be legally accessible. However, tke tool needed is qujjs'tf 
could not be done at Phase 1. ^ 


Moreover, the content is so massive that it would take a hiyfl quality Setuor Intelligence Analyst 
to do all of the post-processing analysis upon such a largc^ulk o£-<tata. One search revealed that 
an attack was done upon Mr Blumenthal’s server on July5^2014 at 07:12 (Bucharest lime), 
and yielded many references to “HRC” within the spreadsheet; 


An explanation of the spreadsheet discussed imtfus memo is summarized below 
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**>:. .c®moxi..««m^xI-vc( :**>^r>> ,x«te< .4W0M,'. .*x * A . 

h»<.,» h*w y>Krt\.nmfk-fai*iiit<Kr': . ’ ■:»£<***ii«w>‘.k»: 

W>*y fc-’.v ;'* : 

hrt_<t>K>v».1 X:,'>_/.vom ■-_ - *&*+*: 
hKmtnvo textov v-jy«bif|;twv ' : S*Jw?y C> ■ 


tKpto+iw.fvnd HfBt 1 *# 4 > 

tpptfctttof'A'n&ftjK ilxZi 
xtKtk xfc:«vW.©p* f fctttv 

#pi*k#d©r/»rxiof>«J5l5$ 

twikMcoK/** AK2MU 
tppffcv&p/vndcpt J3JO 
*4xXk*t>SwV<d.©>* W**« 
•pptetttot/vndop* 153*1 

W'./STXt Cfri isos* 

p* 1IW 
«f»* 1W1 
4 tv&AtterJv,* i** 1578A 
HjpJfcwfcttA'fxl.p** K4i4 
ovtfkxttw/W.oj* Jf>**0 
e^k*«©*/vrxJcf>*lJ9D2 
*nxbMW.(y>yX wtl*U'>y 
K>p«k*rfcjrrVf'd.O{>* 1S23* 
WkjrtfcKv/vnri.of* 
«ptte*t«or/tfnd op*1*352 


Examples of just a few of the indexed entries from the spreadsheet that repressed emails that 
were the consequence of a “direct attack” upon Mrs. Clinton and were sent to Mr. Biumenthal 
are found below: 


mW$4M©«>>i4«5*>*»t*>*«*tWi>M 7/SA0/4 T4t 

tuxA<w>t>x&>t***t^M*uus&}M: r/sifsmi rHai 

ooiwuito^5s^cw^«»aM^c»<<^/&//v-wn a iv 
7/S/201* T:i2 
W/TOl* M2 
7/s/»m >n 

'titt 

««^y*l!p>?»S<lid$*t^»S*4brtb$7/$/J0l* 7 52 
iCT*yr»f»#fcf«i*<W«vi?<H3a««#2wrf</; M2 

7 1? 

<U&»®»*3t24jM>a26(«f2M>?Wo22$«l>*>/$/*>»4 M2 
l&*«:<W>Jj>J.to>4Rt4.'0>(Jft«5jAW?©X*$yI 7/&/3M* M2 

7:32 

0«<4Alaf4fA2'«{t I »4fl/V;27^«‘t5fr5t>4x«2< ;/V2«n4 7 *? 
*»»Wn4fc4»47Mm2d4W«><«4cJ*8tl»7/$/20W 7:12 

«>*»<2a4*iJlWl«MW»«lV»c7ft4R4a<J*i4i7/S//01« M>. 
54*43«3*0»<ri>i?«U27W«lM72*to<J<7/5/2W4 *« 
1/V2024 M3 

^re^<74»M|7^T^ra^ia^394W*0^^W^UM2^ 


It is not (clear whether the cited memos were created by Mr Blumenthal and seijUtfMrs. Clinton 
or whether she was the original creator of the memos ana sent them to Mr^BTumenthal. What is 
abundantly clear is that sensitive memos between the/wo were founjbdn the Dark Web and in a 
foreign country. , ® 


Thus, the above chart meets or excdlds the objeofi ve^ndm i ssi tifr "of the Phase I inquiry. Each of 
the items cited in the sample above could be t^ce^ered with additional research and work, and 
then traced back to the creator. The motpem that this type of data, using these kinds of key 
words, phrases, hashtags, and addres^eS'lmpear in the Dark Web, foreign intelligence services 
would become aware, and then njifl^andExploit them. | 


While wejsanfiot determine the e^act location where the computer is that links to IP address 
84.232^Hu.l54, the Internet Setvice Provider for the box is located at 71-75 Dr. Staicovici, 
Buetiarest, Romania, telephone^!) 21 30 10 888, telefax number +40 21 30 10 892. 


This company is known as Ftomania Data Systems NOC, and its contact email address appears to 
be dan.epure?a-'rcs-rds.io Jrhe lP location, according to one report source is listed as Chiajna Res 
and Rds(Residential, butfrhis has not been checked through ground sources. 


IP Location 

X. Chiajna Res & ftds Residential 

ASN 

IS AS8708 RCS-RDS RCS & RDS SA. RO f.egiste.ed Mar li. 1998) 

Resolve Host 

84-232*210-154.rdsnet to § 1111 

Wools Server 

wfiols.ripe.net 

IP Address 

84.232 210 1&4 
















We also did a DNS look up and attempted to ping the computer to see if it would resolve. We 
found the following results, showing that the IP Address is genuine and is currently operating: 


m 232 210.S54 TraeeroSite 


S-rt* fetuueitetSKvtSfetfe.*, 

• : • :.■ : ■ 

•• . : ■ -•••• •:■■■ 

«k4 

> 'xSS-XS* ; V: • - ' 

-s »** »>* : : »> mm x ' ■' 


,<SSt»< *<«» , 

.... 

■ f c*ccft.'- - .w,& aox««. «&« >»;» 
»«**.•* » r -j 
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|jgg Reman >3 Chiaina Res & Rds Residential-*;*;*;:--; 

OA58?OS8C5-RDS RC5 & RDS SA, RO Cregist 
sll| : H,i998) 


Location: 


R«sdlve Host 
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*««arks*, .-5 *s . 3 , 

1.A : 'AcA A cAAA clAAAAc, 

re-rack:.?-: - A.; AH .. Vl^l-KiCa 

IldT HivKa OF A A, HA A. 

illliiii § M HAAAAF : AAA COHTAC: AAHHA 

111! HI these rriEiE::.- n i 

r ~ rr ; .4 : '!„ .. 

% % jg • •• ■ • $&&£&&§§:* ij ' 

-~-~ -^..s ---4 . 

nr«»Uil; ...... ••> '-i w 0-01 -O1?0O:00: Of*3 / 

last-modlfiPli 20i5«l0-O?T(fSi29i53Z ;: / 


S5CS f:DE 

71-75 Pr. Stai jovaci 

l^achare^pl' 

i+ifi 23 HO 10 888 

+40 21 50 10 S52 j 

dan.spuf«0«s*f(Js ?© /\ 

3fcliSe4gf£$~f<JS.?0 / 

GEPUl-RIPS / 

GEFUl -••. ITE / 
:F.DT2U12-RI?B / 
RDS-MNT / 


remarks: I Fie.? ' y iice^WUSsSftR-KlS.nJ 

for complaints ar.d onvC^fter | 
remarks; i you fXuxVi tried contacting directly: 

(o.tr c»s:.c'«tery jcm^nrfC-ng t 

remarks: tI '* e details registered in RIFE j 

database. / i 

r en*a r K a-: /•*•* •« — *•**♦ ■* ««*. *• .. — •**.«* « 


Xkr: / j 00 NOT CALL, FAX, Of CONTACT OS 8Y 

Y OTHER Ma£»$ EXCEPT 

• rkr: / ( 3feUSe@ft$-fC!S IQ 


ie»3rfc 


2OlfiOl rZmV*: 33: 352: 
2013-05-11103:30:102 
RY PS 


: 4.532 -UfiCWr 
"OS S R03 S.A. 
i ASS708 

npe^anaeixore 

ASeill-MNT 

SnPSs-OP'n 3:04: 86f 
2C<08~0<:~07T:13:04 : 0 02 
RIFS ' 


x/mx« ; 

/aeccr : 
origin: 
notify: 
writ- £>y: 

i« S* -modi fa«P-i 
: source: 













■ 








Advanced analytiGS^^used to do dai 


% tfMrz world’s digital 


In real terms, every person today has a data fingerprint, much like a skin fingerprint. As people 
operate; in the e-commerce world, the “Data DNA” of their digital fingerprint leaves an indelible 
mark that is rarely deletable. Spending patterns, financial transactions, telephone call pattern 
analysis, credit card transactions, travel habits, subscriptions to magazines and online computer 
behavior cannot be altered. While people often try to conceal or obfuscategheir tracks, computer 
forensics can be employed to detect their connection. 

Humans today translate into digital images, both structured and unstructured. Data, pictures, 
soundsj cyber visits - all of it compose a person’s data DNA-tha^s unique to that : person. It 


looks something like the illustration below: i-i 

.* 


extraction, recognizing that: 

content is unstructured or semi?structured, to include: 


Newspapers data sources 

•financial statements contained deep within web sites 
Government reports that are both open and closed 

♦ Press releases on the surface Web 

♦ Websites, both open and closed 

♦ /Emails that are dumped into the public domain 

Semantic extraction is typically used to 


♦ Discover entities and identify their structural ownership and links 

♦ Discover relationships between entities 

♦ Discover events 

♦ Taxonomy generation 

♦ Categorize documents 
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♦ A high-performance data-extraction system that consists of 



Discover relatj$ 
Discover events 


Technically, entity extraction operate s&p&jSV! 


database of 
for Search Engine 


Download of 
Website URt 


e«tify 

Identity. 

Mailed Relations 
inaction of URL 


•***$:' 


Cyfeate 

/ccess 

♦tegration 


mm 


S idney Stone Blumenthal bom[ 

atl 


and curr ently resides 


jtelephone[ 


] Mr Blumenthal’s Social Secihiftr 1 -account number is listed a: 


♦ A design-time compiler 

♦ A run-time engine 

♦ A powerful Integrated Development Environment (IDE) 

♦ Several utility programs 

Tv>,,* y»v- t; »,n" ; I'.?'* 

> •*.* -V."!* *;*t 

‘ o’ a *1; 1 ■ ? 


Semantic extraction is typically -fused > ‘- 0 . A :? 1 <v? 

♦ Discover entit^^y! ^ «*/./*.; |$ (§ 


♦ Discover 


Schema Value 

Normalization Tra«®foimatiOh$ 


As stated at the outset, this investigation is a multi-phase project starting with the Phase I 
inquiry, and once the results are obtained, we can probe the leads deeper and trace back related 
information, if anyf to the original source. Based upon the spreadsheets showing that several 
direct and indirect attacks were executed upon Mr. Blumenthal and Mrs. Clinton jointly, we 
focused first on Mr. Blumenthal’s background in an effort to identify the server location. 


issued fron_ 

given date of birth, to include^ 


_originally 

1ijote that he traces to numerous it erations of his 
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Aside 


from his know n AOL email address, Mr. Blumenthal also traces to 
which was also hacked around July 2015. 


We checked another database- and found some of the reported IP addresses that were linked to 
Mr. Blumenthal’s email addresses, as well as his home address, based upon a search of his Social 
Security account number. The registry is abstracted below: 

. / 



BLUMENTHAL SIDNEY 

ill ■ 


BLUMENTHAL SIDNEY 
S 

AKA: SIDNEY 
6LUMENTAL 
AKA: SIDNEY 
BLUMENTHAL 


Haoo»i flO: mi i/sfii s r i&-a»tsr>i a 

Coumy[ ~ 


(POSSIBLE HIGH RISK) 

Repor ted. 06/09/2000 - 0L ; 3Q .-?01 & 

County^ 


E-mail. 

E-mail 

E-mail 



.IP 8t;d-es» 
address 
-TP address 


We also expanded the search to a scan of the addtggyiself ] / 


Z 


Reported; 

Reported: 10/06/20IJ 
Reoorted: ot.jiSx'otS 




We obtained the following nesyltSs 
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Search Criteria 
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We created a chart of known or suspected relatives, friends, associates and a cquaintances, based 


upon his digital profile, which is summarized at page 310-312 of the basiq 


report 


attached; 


l 


Mr. Blumenthal is an American journalist, activist, writer and former political aide of President 
Bill Clinton as well as a long-time confidant to Hillary Clinton; and a journalist, especially on 
American politics and^^^g‘.?|^cy. He was editor of several departments and wrote for a 
number of publication^^^^^e Washington Post, Vanity Fair, and The New Yorker. He is 
the father of Max Blumfe^ii:^¥fs also a journalist and political activist. 



Mr Blumenthal was bofir in Chicago, to Claire (nee Stone) and Hyman V. Blumenthal. He 
earned a BA in sociology from Brandeis University in 1969, and startcd/iis career in Boston as a 
journalist who wrote for The Boston Phoenix and The Real Paper, twoaltemative weeklies of the 
day Mr Blumenthal resides in Washington DC but also has /ffices and connections to 
California and Chicago. 

Mr. Blumenthal has also used numerous iterations 
SSN: i f 



Based upon our initi 
connected at 


'research, it appears that Mr Blumen thal’s computer or server had been 

1 However, we do not know at this 


juncture whether h/used a lap top, desk top, or if the computer was portable (such as a device) at 
the time of the attack. 


We note that Mr. Blumenthal has a number of devices that he uses, to include phones, but this 
attack was not done upon a mobile device. Every indication is that it was a static and stationary 
server, such as a laptop or desk top. We checked a numberr of databases and found that Mr. 
Blumenthal traces to a number of other addresses in the Washington DC area, to include: 

i 

J for additional inf ormation reg arding locations of Sidney Blumenthal, and his servers and email addresses, please see Attachment #1 SYD 
BLUMENTHAL Basic j R eport 
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f? ; ■ eq*»> ; >.i r , ; ; ;^''v>' ' |p| 

_________ 

s . &*& - .' i M$ m .. «S«StS!p5i 


T(snsU^wi 


€>£C*3n 

■ SwKsrian? 






Hi$fOftCDwJ-<e^«a« i 




KotAvsiSblf i 


?iS6t:#iSSa»: 



WotAvi 
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Connections to Hillary 


Mr. Blumenthal has long time connections to both President as well a$<Kfrs. Clinton. As stated, 
he served as assistant and senior adviser to Bill Clinton from AugtfSt 1997 until January 2001. 
His responsibilities included advising the President on cafmmijJM^ations and public policy as well 
as researching information in the general media abo»(t^th€AVhite House. He became a major 
figure in the grand jury investigation that ended in ;h*J<mpeacHtnent of President Clinton. 

I SwX 

While working on the White House Staf^dClryfelumenthal was known for his loyalty to the 
Clintons, and for attacks on their adv^FB^ries, Vnich is one reason Rahm Emanuel, original chief 
of staff for President Obama, bijFr€d Blumpdthal from holding a position in Hillary Clinton's 
State Department. 

After the House Jmjidiary Committee asfd the United States House of Representatives impeached 
Clinton, the matter then passed to the United States Senate. Mr. Blumenthal was one of four 
witnessesj||rtled t£> testify b^fore^ne Senate. No live witnesses were called; the four were 
edon vidc*>t£gf. 

JPf^ ’% 

His testimony a^essqd'f&e^e^ ,"lie": that President Clinton was allegedly pressuring Betty 

Currie and %iumenthaf to attest that it was Ms. Lewinsky who initially pursued the 

President, not iviqe vj^sa. Lewinsky stated she was the one who instigated the relationship. 

With the assistance oComer evidence and arguments, the Senate acquitted President Clinton of 

perjury and nfrpeachmeht proceedings ended. 

I J 

i “T r®j§Hr 

In 2008;Mr. Blumenthal joined the Hillary Clinton presidential campaign as a "Sen ior Advisor" 


in November 2007. While on a trip to advise Clinton on her presidential campaign 


r 
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_|We find it curious that at Attachment #2, there is 

Ivhich normally w ould be reported. It is possible that he was able to 


not an easy effort. 
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After her January 2009 appointment as Secretary of State, Hillary Clinton wanted to hire 
Blumenthal. However, Obama's chief of staff, Rahm Emanuel, blocked his selection due to 
lingering anger among President Barack Obama's aides over Blumenthal’s role in promoting 
negative stories about Obama during the Democratic primary. 

According to a report in the New York Times, "Emanuel talked with Mrs. Clinton ... and 
explained that bringing Mr. Blumenthal on boaircl v^B^iio-go. The bad blood among his 
colleagues was too deep, and the last ifaiite the administration needed, he concluded, was 
dissension and drama in the ranks. In short.. Mb. Blumenthal was out....” 



Mr. Blumenthal, a longtime confidant oflfejjll and Hillary Clinton,Ranted about SI 0,000 a month 
as a full-time employee of the Clinton Foundation. During the/2011 uprising in Libya agtyaSt 
Muammar Gaddafi, Mr. Blumenthal prepared, from public and other sources, about 25^rrfemos 
which he sent as email word attachments to Mrs. Clinton in 2011 and 201^which she 
subsequently shared through her aide, Jake Sullivan, witl/senior State Depajattfent personnel. 
Written in the form of intelligence briefings, or “SITREPs” the meijvoi^sometimes touted 
Blumenthal’s business associates and, at times containedrather dubiojiarlsourcing. ■ 

The client should note that separately, there is cvjfdaicejkkrtends to suggest that the entire 

■ jbdt “objectively misplaced” in that our 

nth a group of intelligence professionals 
hen ex filtrated by the Gaddafi family and 
:es used by his lawyers and advisors was 
:ntly been referenced in the news. This 
t Recovery Litigation, for which we have 

P 

;s to be successful with this program, they 
lat formerly worked as liaisons with the 
Bank to do the financial traces; and most 
;nt Intelligence Bureau file regarding the 
'0 billion in frozen and recovered assets. 

i government had a strong desire to hire a 
i family assets plundered from the country 
Mumenthal touted his and his associate’s 
1 contractor for the coalition government. 

However, he needed “bait” to entice the State Department to release the data, using his direct 
contacts, with Hillary Clinton. - Thus, the constant Libyan memos, which he and his associates 
crafted based upon information supplied to them by high-ranking coalition members. It was, 
consistent with one aspect of the FBI investigation, an example of an official quid pro quo. By 
giving Mrs. Clinton Libyan data as bait, he could justify his value and worth and in exchange 
obtain State Department intelligence on the Gaddafi money; and then with this valuable 


S For additional information, please see a small sample of memos sent from Sidney Blumenthal to Hillary Clinton that represent "bait” to 
entice State Department to release Intelligence file on assets recovered. Attachment #5 Sidney Blumenthal Sample Memos to HRC Regarding 
Libya 
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classified intelligence; combined with the Libyan Central Bank intelligence use the combined 
files and data silos to track down the missing money for the coalition goverjtpestt. 

As an illustration of how profitable this Program can be, since the BlucegaJfeal #aup had a 
contingency contract with the coalition government, if they found just $1 (.a&sets 5 -; and 

the contingency agreement was just 10% of the funds recovered -extremely 

conservative and considerably below industry standards), it would mean the group would earn a 
windfall of $100 million gross. 


Assuming expenses of 10% of the gross, which would be extremely generous, the net to the 
group would be nearly $90 million. The only obstacle separating Mr. Bliynenthal and the monies 


was the State Department intelligence; and the key to getting it was : 
patron. 


>. Clinton, his long-time 


For these reasons, we assess that the true motivation behind Mr/Blumenthal’s willingness to 
move mountains of data about Libya to Mrs Clinton was all aboht the money and to get ac 
to or actually obtain the State Department intelligence file, notymhstandmg the fact thatjl-'tfbuld 
be highly illegal for the file to be released to a private citizen.. 

Pail of the reason that we make this assessment is that we^fepw a nuraberpffhe members of the 
proposed Blumenthal team who reached p$|to int^|p|s£^e professjptfa^ familiar with rogue 
nation judgment recovery work and particularly those t5iat ire expern in tracing missing money. 
We also are aware that this team created a corporate/vehicte^ffshore; and we know that a draft 
agreement was crafted between the team and the <roalip«rfigovemmeht to work on the project. 
What we do not know is whether the team was^adually operationalized or if the attendant 
publicity surrounding the email server effectiv^ifshut down the Blumenthal team’s efforts. 


dubious sourcing. The New York Post asserted that 
., v _ like mixing up Liby an politicians w ith similar 


v^ai a businessman nameq 


Jwas among 


r's new econom ic adviser s—without mentioning 

as a potential business 


Above we opined the Blumenthal mejHds h 
Blumenthal's "intel was; : §hoddy > >v1m bail 
names. In one instance, Blup*mhal asse 
'the most influential' ofth€Cibyan pri 

that Blumepthal^ya<advising a gro^p of contractors courting[ 
partner." 

TheJ&ftfuse Select Committee ffn Benghazi, headed by Representative Trey Gowdy (R-SC) 
/ed a subpoena on Blumenthal on May 19, 2015 for a deposition to be held on June 3, 
according to Reuters. Blumenthal's name came up during the October 22, 2015 full committee 
public questioning of Hillary Clinton regarding the Benghazi incident, as one of the alleged 
sources of Hillary Clinton's intelligence. During this hearing Democratic members asked that 
Blumenthal's depositipr/transcript be made public so that comments regarding his involvement 
could be placed in cp|fext. The motion was defeated by a voice vote, followed by a roll call vote 
along party lines. 


Mr. Blumenthal has a dubious litigation history: In 1997, Blumenthal instigated a $30 million 
libel lawsuit against Internet blogger Matt Drudge (and AOL, who had hired Drudge) stemming 
from a false claim Drudge had made of spousal abuse attributed to "top GOP sources". Drudge 
retracted the story later, saying he had been given bad information. In Blumenthal v. Drudge, 992 
F. Supp. 44 (D.D.C. 1998), the court refused to dismiss Blumenthal’s case for lack of personal 


5 Published reports suggest that the Coalition Government believes that between $60 billion and $100 billion in assets was absconded by the 
Ghaddafi family and exfiltrated from the country and laundered. 


b6 

b7C 


Page 15 

Privileged and LUiiluiuiiial — Attorney Work Product 


HRC-1839 









jurisdiction. Drudge later publicly apologized to the Blumenthals. Mr. Blumenthal dropped his 
lawsuit and eventually reached a settlement involving a payment to Drudge over having missed a 
deposition. In his book. The Clinton Wars, Blumenthal claimed he was forced to settle because 
he could no longer financially afford the suit. 



We did a very basic scan on Mr. Blumenthal,! mostly in an effort to isolate the email addresses, 
IP addresses, and identity of devices that he was using to communicate with Mrs. Clinton. 

A Global Scan could not be done on Mrs. Clinton because of a number of technical, legal and 
practical reasons, but every indication is that her server was located atjrer hom%but copies were 
maintained in later years at various hosting companies. 

For purposes of this study, the issue is whether Mrs. Clinton’s sy^er was anpertjM^sibiy ente,, 


by unauthorized persons either before or after the entry of Mr,’f 






It is our opinion, based upon experience in cyber defensiv^and^ensivc^pq^^ns, that once 
Mr. Blumenthal’s server was compromised and data was fcuno'%jat ironed many emails, 
attachments, and other data which originated fron/ Mrs; Clings:' such' persons would 
immediately target Mrs. Clinton’s server. 

=^ 7 "-' 



As discussed above, we understand that MrTtfumenthal and others were involved in the Rogue 
National Judgment Recovery:litigation^^peilains to Libya generally and the Qaddafi family 
specifically. As stated above, ther^i^evidence 7 to suggest that one of the possible reasons that 
Mr. Blumenthal was epgaging^tfuh MryClinton on matters related to Libya was to involve her 
in a “quid-pro-quo” relatiprfship whereby he would trade intelligence from HUMINT sources in 
exchange for acces^to the State department Intelligence Bureau file on missing Ghaddafi 
money. 

By way-df brief background, income quarters of the legal community today, there are law firms 
wjMdn participate in Rogue Rational Judgment Recovery litigation. This type of legal work 
involves filing actions agamst middle-level political, military and intelligence persons who, 
having plundered a nation’s treasury for personal gain, but no longer enjoy any form of 
diplomatic immunity. T)re Libyan Opposition Government had strong evidence that the Ghaddafi 
regime had abscondwr with somewhere between $60 billion and $100 billion dollars using a 
number ofdfeyices, vehicles and straw persons. 

As such, the Libyan Opposition Government was soliciting law firms and intelligence operators 
to assist them to recovery the missing money and repatriate it to the Government. 


6 For additional in formation on Sidney Blumenthal, 
R eport 


BLUMENTHAL Basid 


Including location of his email accounts and servers, please see Attachment #1 SYD 


’ We note here that the evidence is in part subjective, but there are some objective clues that support this theory as a motive. Much of this 
section is based upon assessment by qualified intelligence analysts, but requires much additional research at Phase II in order to either 
substantiate this theory or set it aside. 
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There is information suggesting that Mr. Blumenthal, Mr. Tyler Drumheller, (deceased 2 August 
2015) bom 12 April 1952, and Mr. William D. Murphy had formed a relationship whereby they 
contracted with the Opposition Government to try and identify, locate, and recover the missing 
money, in concert with a law firm that does this type of work.® 

Mr. Drumheller, formerly the Chief of the European Division of the CIA, and following his 
retirement created a private intelligence gathering service. 


Mr. Drumheller and Mr. Blumenthal have a long-time relationship that goes back to at least 
2007, when Mr. BhimenlhaL WIPlS. afaftUL claims..that..Mr...Drumheller had information from a 

source identified as|_|of Iraq whpclaimed that Iraq did 

not have WMD or any components thereof This debunked the Bush Administration’s narrative 
for the need to invade Iraq, at least according to re porting by B lumentfral, quoting his source Mr. 
Drumheller, who claims the intelligence came from | | aroun(^20Q2. 

Normally, the operators and the law firm work in tandem and eni/y a percentage of that whtpkls 
recovered. However, someone must fund the start-up operation which can be quite expensive 
because it involves specialists who are experts in big data/analytics, money layjrdering, and 
concealment of assets, identity resolution, and tracing of cojjverted assets. 

In this unique circumstance, Mrs. Clinton had jurisdiction ovep/tfie control of the State 
Department Intelligence Bureau file that containeiymuch analysis and ultimate success in 
freezing nearly $30 billion in Ghaddafi money, plus, wyjr'such a file in Mr. Blumenthal’s 
possession, combined with what he^ld obtain Me Libyan CentralBank data from the Libyan 
Opposition) he could sling shot ahead of the m finding “the missing treasure.’ 

r . % 

Assuming that another $20 billion was asmiissmg|and assuming that Mr. Blumenthal 

1 1" it 1 .1 ,i i , vwt . rfWawP* • , i 'll* r .1 i Ml* 


wot) 


and his colleagues could ti|| the legjj&yrifcV 
and assuming that he%?as 
million. But, kev to sii 
intelligence file; < 


rwith 


dora^to fHpzejust $1 billion of the $20 billion 
oii a^fO% %)ntiit^icy, the net to his group would be $100 
~ / enfc and its ^success would be the State Department 
yan CeSalral Bank file. 

% 

So, accorditt^ti^this ^qifpBlun|6idi%is sending all of these SITREPs to Mrs. Clinton in an 
effort to^pmne the pump’lftnd obtain the file with the argument that every dollar that his group 
is ajjkMo re-patriot to the Uoyan government, either directly or indirectly (via the State 
artment) is a dollar that the US taxpayers do not have to fund. 




There is also obje ct! ve 


ice to indicate that a person identified as 


ective gvi den 

telepjrone j _ _ 

f^i.rca. 10 January 2012/ began to solicit Senior Intelligence Analysts with experience in 


repafrMipn of assets/plundered by the Qaddafi family. 
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* While Mr. Murray has a long-time relationship and connection with sources In the Middle East, partly as a result of his long-time service at 
the CIA as a Senior Executive Officer, but also through his company Alphom Group, IIC. However, the Rogue Judgment Recovery Work 
assignment, it is believed (no sourcing) was not done through Alphom, but through some other offshore vehicle. 


]has several other companies, to Include^ 


elsewhere. A full brief can be provided on him as nece ssary, bu t baslcall^ 


~las well as other addresses IrT 


,_3> nd 

Idissent who 


ce ssary, bu i 

has been a naturalized citizen in the_US_sinc,e around Ills has longtime connections tfl the US-State Department that'date to the 

199 0's and was actua lly covered a^___ [where he served a] fe s he 

was | 1 His primary employer as | | at the time wad | As such, he was 

also a self-styled liaison from the State Department to a number of US-based intelligence services owing to his experience In the Middle 
East. A full brief on him can be done, as necessary. 
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This person began the solicitation process on approximately January 25 lh 2012, claiming that he 
was dealing with representatives of a “high level political types in the US within the State 
Department” and that he personally had top-level contacts within the new Libyan Opposition 
Govern ment: and that he would have a contract to assist in beginning the repatriation process. 10 

Proof of|_|involvement in participating in the program, and seeking the 

guidance of others, is found in this post-meeting summary memo that was sent to him: 


Thank you for your email. Oo vou haw a «eadSh« on I 


2 p*eer 'C.' : : 


I frays to ?>« in DC most of the dsy. t wrti work er> it tater ovtfrss averting 4 V. y 




In a meesa^ Jat«4 J/25,'2012 3-12:30 P M. easternSranaar a ■ 

tZD 


; '-nK-ii >***»<* ytiif VttSV c&it : 


| &***& a ***** «ft? $»:«>* ** j 


r- - ' v . 

: 


: A<r M >Im r>K<sv^ wvC' *t8.r£*N&& ::K*t Uj'&!$>,» glfv-WWW* : 

: *f»ri tf*w»vr $&£$§*>.• fw pfkw'Mg /»p*r»n.*»r ftp sftwftfWW *** ******* **<*' \ 

: >xf », {fv^*v'lrrvr v» y*v> nm «*jrR ftrjw **<*■ **>*>*• hrt*,**n fk* *■-»*-> <*•>*#j&ti '\4»« \ 

aurnttciOvuntm «.:<■•«..Pinka«<*»wr. **.:»»««;!:>«>'»£:«* s»*e«*»s h»* Mw'ujpfFsccmtci 
**•>««<'* * to- - «w* <»5>erf<fte n<- <■ air vc v for,- u» «v •». ific »c, fit rv« aRiMi eve* ct Mp&m:- ■ > «>*«< i i**#* trawi* I • 

ilSVIMtiutu 1>^4IK Wlklbtuviui / 


The dates when these contacts were made by [ //* "j fit the time line of when Mr. 

Blumenthal was crafting the memos regarding Libya/and other issues to Mrs. Clinton. While he 
never overtly states that he iaijieed of infopntaj/on regarding Qaddafi plundered assets; the 
memos clearly contain language that isJjja^feunwi, would not inspire a lot of faith and credence 
by Senior Intelligence Analysts that^dt together all source HUMINT and SIG1NT packages for 
planners and policy makers. \__ / \ 

As recently as 20l4^edording to publipned reports._is quoted as claiming he 

had a direct contractual relationship wit n the Libyans to track down “assets that had been spirited 
out of the cpHfitry by Gaddafi’s iimw circle”. One of the leads that he was focusing on at the 
time wa^tKe Am an Bank, which allegedly was used by the family as an ex filtration vehicle. 

Sourcing embellishments and^naracterizing the level of access, and the placement of HUMINT 
sources, and claiming multiple unconnected HUMINT and compartmented intelligence is a 
dubious practice. Report^'Officers simply do not craft SITREPs or presentations using these 
kinds of characterization^. 


Rather, the ring to these memos is that it is being done to “shake and bake” and provide Mrs. 
Clinton fodder forym*guing that an exchange of data might inure to the benefit of the US (looking 
at it in the light most favorable to the parties implicated) Community and the American people, 
as well as the Libyan Transitional Government who were totally reliant upon US funding and 
strength. 


Indeed, unbeknownst to this author at the time (January 2012) [ fr ras - it is now suspected - trying to assemble a te am of 

former hieh Level CIA operatives with Middle East experience to help him round out the "technical team". In January 2012 | ~| 

_pid not state to this author that he was working directly or indirectly with Mr. Blumenthal; only that he was part of a team 

being assembled, that they had a contract that they had a funding vehicle for needed seed money, that they had a Chicago-based law firm 
and that all members were former USG Intelligence Operations Directorate personnel. 
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particularly at[ 


has a rather controversial history within the US Intelligence Community, 
| His links to | ~|vas one of the 
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prime operatives in Libya, providing 
Notwithstanding his reputation in the US Intelligence Community, he was believed to have 
highly placed contacts within Libya which could have been mined for creation of a Rogue 
Nation Asset Recovery program, but for his limited technical and intelligence analyst resources. 


Is it a stretch to believe that at one time or another 


did not 
shake and bake 



Mr. 
SITREPs, 


BluhAv.'iial, Mr. Drumheller and Mr. Murray, who were creating the 
and /4§ich he would provide access to the Opposition Government to contract for recovery of 
the plundered Qaddafi assets - ' WLile the time line and the relationship, ^connections, links and 
possible association atmosphe'Av Co fit, it is still just circumstantial at present. 

WMm 

But. so goes the possible theory If BlumSfc&sl was able to locate/nd re-patriot the money, it 
would be a huge win for the US State Depgfissnt as it could claim they suppressed the m oney^ 
laundering efforts of the Ghaddafi family and repatriated the money to the rightful o 
moreover, saved the American people the cost to fund: reconstruction of Libya thrsMiS 
repatriation effort. 

However, the legality of such an arrangement, outside^of normal Ufj^Gbvemment 
authorities and governances is questionable. Such a “qyfd-pro-quoxrfould be looked u: 
within the Community with great caution and disdain* particularly after it was learn 
Blumenthal also had a pecuniary relationship with th/ClinJerfflfoundation 

Again, we caution here: We have no definitn^r'"evidence that Mr. Blumenthal actually was 
involved in the above engagement with the>rlvyan Opposition. All we know for certain is that 
he was soliciting Senior Intelligence andlystg during this period to participate and lend a hand 
and was doing so using Mr. Murr^y^nd Mr/Drumhcller. 

We know that the Libyjjar'upposition C/ovemmcnt was attempting to contract with intelligence 
professionals to ragdge in this pr^ppF We also know that they were seeking - through 
intcrmcdiarics^legal counsel who&W<. long experience and achieved some success in rogue 
national judgment work. And, X'fc kaew that Mr. Blumenthal was passing to Mrs. Clinton 
dubious SITREPs that heswas/haracterizing as atmospheric HU MINT reports from alleged 
licence sources in LibyavT^s stated above, we also know that l [ definitely 

did have a contract with the^pposition Government as recently as around 2014, according to his 
self-confessed claims. 
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Further,Aye also know that the Libyan Opposition, a s recently as December 4 2015 was seeking 

to re-iunite t his program usin g a man identified as_ 11 Our information 

suggests that j / was working directly for the new Libyan Foreign minister “on an 

initiative to locate 4nd freeze Libyar^ assetsbidder^ by Kaddafi around the globe.” He 
also stated “...Until the political situi^W^stable and a democratic government 
is elected, all these assets are in dangi^c^ &r misused by politicians or treasure 


hunters.” 


The email address 


*i 


.p'W, vwrr; - . 
'»A A S*I -‘,'4*5 e 


is identified ir» i 


IAILjUL 


S nal information on this event, please t 
seeking to partner with a local lawtffrMtef (CMsevrl 


^cv/ttllon of an email dated 4 December 2015 fron j ~| 
SssbahsAnt 48 LIBYA ASSET ROGUE NATIONAL JUDGMENT 


RECOVERY PROGRAM 
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We note thaj _ 

| and as of December 2015 and January 2016, was 
seeking not only Senior Intelligence analysts, but legal counsel in Washington, DC. 

By way of brief background] 


After working for[_ 
enterprises including 


for several years, 


started several private 


In addition to operating several businesses in the United Statesl / __jalso served as a 

_ I hfe served on the board or 

exec utive committees of several non-profit and community organizations. Most recently hefcts 
been| / 


is passionately interested u 


He has strong links tof 


fwho lives ii 


Ifeas been active urlhe Libvi(n revolution since its inception in February 2011.[ 


___|rs acjtfve in Washington DC’s political circles with extensive networks and 

relationships about Libya and its democratic transition. He frequently participates in programs in 
prominent think tanks and meets regularly with policy makers and government officials 
regarding Libya. He maintains strong relationships with important political actors in Libya and 
continues to advise successive Libyan governments regarding Libya-US relations. 
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Another person linked to bothf 



operate^ 


His business career started in | 

| He also owned and operated}] 


owned and 


sited | _ 

Currently, he owns and 


An active community member j | is involved in/ocal and state politic^ffe is a 

member of va rious community and political groups and is/especially intereste^m inter -faith 
work. Prio r tof~ / y 7 |was a 

member of| [while be resides 

maintains an extensive network of contacts in Libya 
political leaders and civil society groups. ||; 


lere lie travels frequently to meet with 


We are not suggesting that any of these men engat&J'tfmh Mr. Blumenthal: However, what we 
do have proof of is that this group is working jjyectly for the Foreign Minister, and are seeking 


to recruit American Senior Intelligence 


; and legal counsel to contract with the Libyan 


Opposition Government and seek to^e6ovej/the assets, and did so a recently as 4 December 
2015. Ilf 
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Thus, while there mavbe^arcurastantial^evidence that a scheme was underway; to this day, there 
is no concrete evkjedce showing that 0dr. Bluiltenthal actually did achieve a successful quid pro 
quo with Mrs^Clmton. 

Hovyetfer, at Phase II, we would/fecommend that it might be worthy to make contact with the 
forementioned organization yrnd see whether the Libyan Opposition Government ever 
contracted with any groups,^Organizations or individuals and received reports, memos, work 
product, contracts, corporate vehicles, etc., regarding asset repatriation, without regard to the 
Blumenthal group. 


Normally, iff 


]had indeed hired a new group of forensic financial experts or 


Senior Intelligence Analysts, this follow-on organization would ask for copies of all memoranda. 
They would want to have this so not to duplicate past efforts that proved fruitful, or mine the 
data that was recovered for additional leads. If the Libyan Oppositi on Government did indeed 


contract with Mr. Blumenthal, it is logical that) 
data. 


has the ability to obtain the 
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While we cannot state for certain at this juncture in the research, that Mrs. Clinton’s server was 
directly penetrated, we did find a sample of a particular document within the Dark Web that 
traces back to her exact IP address where her domain email server was located. This document is 
a summary of known and suspected Libyan terrorists who were in and around the Benghazi 
area. 13 If genuine, this document would enjoy the highest level of classification because it could 
be used for targeting and would be a record that the Ambassador-in-counjry would have access 
to as it was probably obtained by the Chief of Station or an Operations Officer under his 
authority. 

Moreover, this document was not found on Mr Blumenthal’s serv^/so it was not sent by him to 
anyone and was not received by him from any source. 

Rather, it was found in the Deep Web and traced back to MrsyClinton’s IP only, fhpretore, one 
possible explanation - using every reasonable inference -- that it came fromMiv Clinton and 
that her server was penetrated. Much more analysis would need to be dcjjwf'on this and other 
documents that could be recovered to determine \yjten,/if and how Clinton’s server was 
penetrated and where the documents landed. 


Attempting to trace back to the providencepf^fTiS^p.e'^gtnnent (Attachment #2) and i< 
places where it landed, would take sojp^efiort. fhfc.cli^^iay wish to expand the research to 
include a complete GlobalScan se^rCh, which rep'eser? t tfee^deepest and most in-depth scans that 
are available in the COmmerptdi database world toddy. Reports can range from 800 to 4000 
pages long, whenincludjftgexhibits. 




Global Scan cijfKtfe done on a^jr^on in the world, and costs depend on the name, address, age 
and otherjUhmtifiers for the person. To date, we have processed over 20,000 GlobalScans since 
our i|>4*^mon. After 1996, the GRobalScan always included digital media data, usually from the 
||p*5purce so that they covAd be used in a legal proceeding. 

Since we have much expejrfence in complex digital intelligence research that involves databases 
and electronic sources, pur experience has shown that the only effective way to conduct such a 
study is the Global Scarf® on each person or company or document that we find and trace it back 
through the movement evolution. 

We assume permissible purpose exists for conducting all appropriate database searches. This 
matter must be confidential and privileged and done pursuant to the privileged communications 
doctrine and the attorney work-product doctrine. 


13 For additional information on a sample of one filerecovered from the Deep Web and the Dark Web which came only from Hillary 
Clinton Server, please see Attachment #2 COPY OF IVSfeV+f-SfAtiST GRACED TO CLINTON SERVER EMAIL 

“ Please note that some searches require a permissible purpose as defined under the Federal Fai r Cred it Reporting Act, Title 15, USC 1681, 
et. seq., as well as other local, state, federal and international laws. You are required to c ertif y te j fr hat any search is in compliance with 
both FCRA, as well as the 1999 Graham-Leach Bank Privacy Act. By placing any order witlljthe client represents that the client has fully 
complied with all local, state, federal and international laws and assumes all responsibilit y A ssumes no responsibility for determining 
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However, as stated at the outset, the only exception to the privilege when using Global Scan is if 
records are found that are demonstrably apparent to be classified, even if not overtly marked as 
such. If this is found, we must stop, turn over the implicated material to the FBI, and seek their 
guidance and support. 

This search permits us to cite the costs for obtaining all other information within each 
“information corridor” that may be identified during the initial scan. 


It also enables the ultimate client to maintain control of the scope, direction, and cost of a more 
extensive investigation. Each proposed search item is listed at the end of initial report. 


For example, a Global Scan® will cite the name and address of a banyan account number, the 
signatures on the account, and when it was opened, but will not provide information regarding 
balances or activity. However, the Global Scan® will cite the exacj/cost for obtaining that next 
level of information. 




Normally, GlobalScan® always includes the following cappij|& of data: 

\ 

a. Banking, Financial and credit relationships, including addresses and namrc 


b. Real estate holdings, real estate trusts, and real property conveyao 

„ s' 

c. Corporate affiliations, executive associations, and sCif-confcsscd employment. 


r 


.. % 

nstitutions. 


d. Credit reports and personal financial scans. 


e. 




Litigation, including criminal arrests ijU+lci/areas of residence. 

f. Newspaper, magazine, trade jojH'nal, andAvire service reports. 

% JS 

g. Known associates, fantHy members aifd dose personal friends who may be used to transfer 


or convey assets. 




h. Vchicles>j»tfats, mechanized equipment, and recreational devices traced to merchant’s name, 
addcesSor SSN. 


s UCC filings recorded in thomame of the merchant, based upon a scan of the person’s name, 
SSN, or past addresses, ^/niplc secured search. Included is both debtor and secured party 
searches. 


M , • 

j. Identification of trade creditors, credit card companies, utility companies, banks, or other 
entities that the target would be paying with some type of instrument. These searches do not 
include identification of the bank that a check is drawn upon, or the account number, just 
the bill that is being paid. 

/ 

k. Identification of telephone numbers, cellular numbers, and mobile telephone numbers; 
together with long distance carriers. This search does not include a detail of the numbers 
dialed, or the subscribers to the numbers dialed, which can only be obtained at the next level 
of searching. 


1. All past addresses, historic use of addresses, names of relatives, names of persons traced to 
addresses used by the merchant, names of relatives and the statistical identifiers of those that 
reside in the same household as the merchant. 


whether the client is in compliance with these laws. We are not a Consumer Credit Reporting Agency and all of our reports are done as an 
agent to counsel under the Attorney Work Product Doctrine. 


Page 23 

Privileged and Confidential — A t to r ney Work Produci 


HRC-1847 








In actuality, the data flow appears something like that which is depicted below: 



Global Scan® is conducted on a flat fee basis o 
seek to have a gu aranteed fee structure cited in a 
be preparedl_requires that all cited fees and 


arketed that way because clients 
oreover, before any Global Scan® can 
se surcharges be paid in advance. 

| | does not bill by the hour for its seryrCoS nor use “general price lists”. Rather, it uses the 

“bundled billing” approach. In shprf^ther fee is guaranteed and includes all research time, 
computer data downloads, analysis, report preparation and delivery. We may consult with 
counsel by telephone or^jn^fl following transmission of our report, should there be a need to 
clarify a few points ip-<5ur report. This approach guarantees the client all available information 
for a pre-cited charge without regar^to the amount of information obtained. 


We also can conduct deepoj^prdbes, depending on the requirements of counsel, the permissible 
purp8.Se to obtain the information, etc. In addition to the above mentioned eight categories of 
data, we can, under certain circumstances provide a more in-depth report and other kinds of 
advanced searching. Tjre cost for each depends on the nature of the request. We checked Mr. 
Blumenthal’s digital data and found some or all of these indicators are present: 




ln~D?pth :-":C V \ 


1. Social Security Numbers and DOB Search 


2. Social Security Trace for all addresses, verify date of issuance, state of issuance and 
whether used regarding banking, financial or credit transaction 


3. Date of Birth Records 
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4. Death Records 


5. Change Of Name Records 
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6. Marriage and divorce Records 

7. Criminal Records State or federal sealed or unsealed felony or misdemeanor 

8. Warrants of Arrest 

9. Order of Protection, domestic violence offender scans 

10. Probation Records, special offender searches, including sex offender registries, or 
habitual offender status 


11. Property Tax Records 

12. Utility Bill Records 

13. Current Address 

14. Driver’s^gg^e Information 

. : • ' , 

15. Car Insurance Records 

16. U.S. Postal Service Forwarding Address Re/ords 

17. True owner of U.S. Postal Service PO B0X Recor 


18. Magazines or Newsletters that you a^eBpHSwner of. (Postal Records) 
jS^.'l^lo^^'P^iU^elords(US I>^alService) 





lay subscribe to 
;S4f.ed from a library 
egister 


24. Credit Records: 

25. Banking, financial and credit relationships that include name and address of bank 

26. MVR Reports 

27. TAG&/lN Traces 

28. License Plates (Name and address can be$&s*(^ by doing a license plate search 

29. Full Driving Records, including searches »f >f«8onal Major Offender Database 

30. Military Records Search, including discharge status, branch job and rating, dates of 
Enlistment, Reasons for Discharge 

31. List of Hospital admissions and possible diagnosis codes 

32. Telephone Number Historical Index 
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33. Cell Phone Trace 


34. 

35. 

36. 

37. 

38. 

39. 

40. 

41. 


Unlisted Phone Numbers Decodes 
Illegal Alien Database Scan 
Government Job Registration Scan 
Worker’s Compensation Settlement or Claim Scans 
Automobile and Personal Injury Insurance Fraud Database 
Real Estate, Co-Op and Full Title Search scan for 50 yea*^ 




Leads for identifying hidden or sec^ix*# assets that are in the form of T-bills, bonds, 
stocks, "offshore" bank accounts, or funds in tax haven countries 

College Records Search, verification of collegey«tttendance, degrees and 

special awards 

Terrorist or Cult Member Dossiers 

Professional Certification by various professional t&(3e associations 

Business Conduct Searches through dataj>a<es such as Better Business Bureau 

Federal Bankruptcy Database &rans, including whether cited in an adversarial 
proceeding, or as a daimanpffany bankruptcy action by others 

Catalogs, Mailing Lists, and department Store searches 

Employimyrt'Searches for/a period of 20 years, including job titles and descriptions, 
addresses, and possible level of compensation 

'mi professional Licenses Scan 

Business licensesymotor vehicle licenses, pilot licenses 

Evictions and ^Tenant Landlord Database Scan 

Voter Registration Database and scan of historic voting record 

|j|mail tracing service and complete Web Site Domain. 


By way of background, the “Deep Web” — a vast reservoir of Internet content that is 500 times 
larger than known “surface” World Wide Web material. What makes the discovery of the Deep 
Web so significant is the quality of content found within it. Deep Web searches are intended for 
cases where historic data needs to be obtained and which otherwise tends to “fall off’ current- 
day data tables. 
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Searching on the Internet today can be compared to dragging a net across the surface of the 
ocean. While much can be gathered from the top, there is a wealth of information that lies 
deeper, and therefore is missed by the average person. 


There are hundreds of billions of highly valuable documents hidden in searchable databases that 
cannot be retrieved by conventional search engines. The reason is simple: basic search 
methodology and technology has not evolved significantly since the inception of the Internet. 


Traditional search engines create their card catalogs by spidering or crawling “surface” Web 
pages. To be identified, a page must be static and linked to subsequent other pages. Utilized in 
this manner, standard search engines cannot “see” or retrieve content in/ne Deep Web and the 
crawlers used by them cannot probe beneath the surface. The result is that enormous amounts of 
data remains untapped and effectively “hidden” to the crawler, while jk reality, tire material is in 
plain sight. 

The discovery of the Deep Web is the result of groundbreaking sfearch technology develop 
the Intelligence Community. Private companies have only recently developed search 
capable of identifying, retrieving, qualifying, classifying aryd organizing “deep” surface” 
content from the World Wide Web. 

The Deep Web is qualitatively different from the surface Web. DpeffWeb sources store their 
content in searchable databases that only produce results dyijarfucally itfiresponse to a direct 
request. But a direct query is a “one at a time” laborious wayio search. 

Our search system automates the process of making dozens of direct queries ^tkiutaneously 
using multiple thread technology It allows^earchers to dive deep and explpri; bidden data 
simultaneously from multiple sourcesu*«Igdirected queries. 

Businesses, researchd^|p^a!f^imiers”'Mw ha^gthe most valuable and hard-to-find 
information on the W^Jj^nd can retrieve it accuracy. If the most coveted 

commodity of the Information Age is indeed $&cn the value of Deep Web content is 

immeasurable,^— / 

'^^5, : . ^ 1 !»um t i 

Whep^tfnducting Deep Web intodigence Studies on companies or individuals, we access a much 
Jtfferent class of documents. Included in the search results are not only the standard information 
'retrieved by conventional sea/ch engines but many other possible leads. Some of the highlights 
of the Deep Web search include: 


1 . 


•lie information on the Deep Web that is 400 to 550 times larger than the 
World Wide Web; 


commonly defl 

2. 7,500 tcrabyt^of information, compared to 19 terabytes of information in the surface Web; 

3. 550 billion individual documents compared to the 1 billion of the surface Web; 


4. Information from an additional 100,000 Deep Web sites; 

5. 60 of the largest Deep Web sites collectively contain about 750 terabytes of information — 
sufficient by themsthres 10 exceed the size of the surface Web by 40 times; 

6. On average. Deep Web sires receive about 50% greater monthly traffic than surface sites 
and arc more highly iseked than surface sites; however, the typical (median) Deep Web 
site is not well knows jap ifw* pater net search public; 
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7. The Deep Web is the largest growing category of new information on the Internet; 

8. Deep Web sites tend to be narrower with deeper content than conventional surface sites; 

9. Total quality content of the deep Web is at least 1,000 to 2,000 times greater than that of the 
surface Web; 


10. Deep Web content is highly relevant to every information need, market and domain. More 
than half of the deep Web content resides in topic specific databases; 



Web sources is nepeSsaty 


11. A full 95% of the deep Web is publicly accessible information — not subject to fees or 
subscriptions. 

To put these numbers in perspective, we estimate that some of the largest search engines, such as 
Northern Light, individually index only 16% of the surface Web./Since they are missing the 
Internet searchers are therefore searching only Q.03%/-- or one in 3,000 — of the 
to them today. 

of multiple surface and De^ 
is needed. _ 


identification of Deep SNjk sit^ anjMfidi retrieval pifH 
We have also developed a .direct-acpeSs query engine trans 
collected, eventually groyingtpHl50,000 Sites, 
that when the hit score^lH)elow:65%, they are not deemed reliable 
and the hits tend to be unrelated to the target ofjjrcinquiry. 

Graphical|Sf|||& comparison of the D&f \tydb compared to the “surface web” looks something 
like this: 


when 


%W&9 
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During the past several years, the Department of Defense, led by the Defense Advanced 
Research Projects Agency (DARPA) has been steadily working on a project called the NOISE 
database, known as Name Only Index Searching and Exception. The acronym NOISE came 
from the negative consequence of conventional searching of the Open Source, Web-enabled 
applications such as: 

www.altavista.com 
www.norihmtiight.com 
www.Ivcos.com 
www.opendirectorv.com 
wwwwavbackinachinc.org 
www.googIe.com 
www.cuil.com 


Visually, the process of gathenng information on a persyn 
figure below: 

THE TOP DOWN V! 


www.msn.com 


ething like the 
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••vXv.: 


till 


The 


Traditionally, these are “Name Only” or “Business NafipHSnly” or “Telephone Number Only’ 
searches that return massive.; unrefined resi»itg. AiMfi^the search criteria is common, the return 
results is often “NOISE* : burderisjthe analysj^^n a vast amount of irrelevant information. 

In the commercial or legal markets spadS, the /amt is true, but the pressure is even greater to 
obtain results quickly, efficiently^^rfa within treasonable bitdget. 

m ^ v " 

)f the NOISE /pplicatiqu is particularly useful in certain kinds of 
^^irrenf Clinton cast. It has been used to “walk back” information claimed 
to be glea^^^&'|^ig%.|P soiirces/as it can be fished out of the Deep Web and effectively 
converted*# usd by arFalysts. 


data searches be 


reason, we suggest th^rt NOISE application and the | ,___„ „ 

^C^idered here because of the Relatively common names of Advantage and the key individuals. 


It is the union of the NOISETapplication and the restricted access data within that is 

only available with a p^raiissible purpose that allows for a highly relevant, targeted search 
approach, It looks something like this: 


b6 

b7C 
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SHI 


In the DoE| 
data aboutSf; 
faxes, emajti&T ‘ 
digital 
more i 


was tasked with the order i6 find a means,gpufmar 
res, dates of birth, ages.vpast addresses, pionshnunfiers, 
;sses, businesses, names'of relatives, etc.T<»fthe so called 
that intelligence info the web-enajjtea application for a 


For commbffj^i»it^it5(e^^j^&^i?jlled down from perhaps^2*000 to 120 Moreover, the data is 
highly rifle-shot ^archme^Because the name Hillary Clinton or 

Sidney Blumerifha'l are so commoirand lead to miUMsof stories and hits; this is the perfect tool 
to cull through the mountains of data that exisj^t^roth within the Deep Web 

The second compelling reason thisjKfw forjrf of search technology was developed is that the 
Internet and the Deep Web ispwlch largepand vaster than any database source on the planet 
today The “Deep Web V^metimes kn6wn as the Internet Dark Space or the Deep Web 
Intelligence Center, i^vast reservoit/of content that is 1,000 times larger than the known 
“surface” WorldJVtile Web What mAes the discovery of the Deep Web so significant is the 
quality of ccjjHgnt found within. In^very real way. the Dark Space of the Internet is much like 
the outep-stSacc: Its depth and size is not mcasurcablc, indefinable, and endless. 


le old way of searching, looks something like this: 


However, the new way, .yieludnig use of NOISE and 
granularized, looks som6$#g hfee this: 


data that can be 


b6 

b7C 
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ill 


will 


This new capability allows searchers tc 
simultaneously using directed quep-lsv? 


fep and explore hidden data from multiple sources 


When you combine th(v^{s'^|."^ilg able to “Deep Dive” into the Internet, with the ability to 
access restricted data that is mostly available only to law firms or those 

with a permissi^€purp fe^^ ^ft.'D0B, Past Addresses, etc.), one can significantly expand not 
only the seartmable dafwki^i^^^^p so with highly accurate results. 


Businesses, researchers and con4irhiti|now have access to the most valuable and hard-to-find 
information on, the Web and oan retrieve it with pinpoint accuracy. Searching on the Internet 
today can be compared to dragging a net across the surface of the ocean. 


However, there is a wealjn of information that is deep, and therefore missed, hence, the Deep 
Web. The reason is sample: basic search methodology and technology have not evolved 
significantly since ther inception of the Internet. Traditional search engines create their card 
catalogs by spidering'br crawling “surface” Web pages. 


To be discovered, the page must be static and linked to othdipi|§s. Traditional search engines 


cannot “see” or retrieve content in the Deep Web. Because traditional search engine crawlers 


cannot probe beneath the surface, the Deep Web or Dark Space of the Internet has heretofore 


been hidden in plain sight. 


The Deep Web is qualitatively different from the surface Web. Deep Web sources store their 
content in searchable databases that only produce results dynamically in response to a direct 
request. But a direct query is a “one at a time” laborious way to search. 
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NOISE automates the process of making dozens of direct queries simultaneously using multiple 
thread technology, and takes private, non-pubic financial information and pulverizes it for 
inclusion into the search query. If the most coveted commodity of the Information Age is indeed 
intelligence, then the value of Deep Web content is immeasurable. 







Today, more and more people are “self-confe: 
prejudices and their flavors and peccadillos. It i 
web sites as Facebook, MyLife, Linkedln, and 
All of these locations are trawled, but the key 
advanced analytics applies. 


abits and haunts; their biases and 
inantly done on such Social Media 
er public and private chat portals, 
instrument or vehicle used and the 


Our technology specializes in the developing of these wide and deep data mining nets and tools, 
where it is launched upon an endlessly sized ocean of data. Some of these data sources include: 
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Avthortty St?* 
Placement 


■ Sidne/Blumenihal r S server was the target of repeated attacks 

he penetration resulted in the exfiltration of Hillary Clinton’s 
r. Bfumenthal’s server to Bucharest, Romania, where it was 
id4ncrypted server domain. The data than moved to a second 
/ to be controlled by Guccifer. This is troubling because it 
ide of the control of Guccifer to some unknown third party. It 
ing spill that, at least in part, included data that directly or 
indirectly originated from thycbmputers or servers of Hillary Clinton and Sidney Blumenthal. 

This Romanian domain locality than collected nearly 37,000 files and hosted them for a long 
period of time, many o&vvhich came from a direct attack upon the server of Mr. Blumenthal, but 
also include direct attacks of others. 


One of those persons is believed to be the email domain server of Mrs. Clinton because one 
document was found on the Romanian domain that traced to the IP address of Mrs. Clinton, and 


■ ■■ \ 


one document wgs recovered successfully, but many others could exist. We just do not know 


because in order tp= definitively determine this, one would need to download all of the 37,000 


files, and then open each to see whether any can be directly linked to the Clinton server. 


The Clinton security people claim that “security logs of the server show no successful 
penetrations or attacks ” This statement or assessment is without basis in our opinion. In reality, 
one cannot determine from internal security logs alone whether a sophisticated pernicious attack 
was executed. 


Page 34 


HRC-1858 
















There is a multitude of ways that a penetration and exfiltration can occur and no trace is found 
within the internal security logs of the targeted server. This includes direct, indirect and 
collateral attacks upon the email domain server, such as was most likely done here. 

It is inescapable that a security breach and a violation of basic server security occurred here, both 
with Mr. Blumenthal and Mrs. Clinton. 


The State Department and the IC basic security protocols regarding email servers for personal 
use was also systematically violated by Mrs. Clinton. The fact that we found emails regarding 
attachments that describe the names and identities of targets for attack in Libya that date to about 
the time of the Benghr|pg$($ck is particularly troublesome. Such a document, if authored by a 
US Government empldl SlIs io enjoyed original classification authontVwoul||gnjoy the highest 
level of classification, 1 hHHP probably Top Secret - SCI and a SAlfCode. The fact that this 
document was found in “the open” and has no security classificationycollars is highly suspect and 

deserves critical review and analysis. _ 

3 PEMIKniil-IS.IinSBl!: 


In this limited, Phase I inquiry, w 
server was directly or indirectly att 
the Deep Web and the Dark Web ( 
|ie attack was a pernicious!; 
server outside of the US. 



I taj 

;rs to each of®* 

5ne whether I 
mindful of classification issues and Our legal oblj 




I 1*- 

questiMl 


ajfre solely whether Mrs^CTintOn’s 
^contents could hpdound within 
records couldjxfobtained (d) and 
: records might on 


further studies are recommended 
ils can Belobtained and recovered, 
Ions as discussed above. 


Separately, we assess that Mr. BlumejjthCi’s/rue motive : for being so aggressive in providing 
information to Mrs. Clinton regarjUttg Benanazi and Libya was to “bait” her into releasing the 
State Department intelligencg^fffe (a classified record at the SECRET level at a minimum 
because it came from foj&rgn in-countiVaiplomatic or official sources) that contain a roadmap 
on how the State Depaftment seized thp Qaddafi family assets that had been plundered from the 
country. The S^fidnllion was only a jrortion of what the coalition government suspect was taken 
from the Ufrymi people. 

Wp^understand that Mr. Bluin/^nthal-ipresented a proposal to the coalition government that 
Included a team of experts in snoney laundering and repatriation of absconded assets, but it was 
wholly dependent upon his ability to obtain quality digital data from disparate sources to fuel the 
tracing and tracking.software. We believe that Mr. Blumenthal team members made clear that 
he would freed: 

(a) The compete financial database image files of the Libyan Central Bank 
during the Qaddafi years; 

(b) The complete State Department intelligence file containing all information on 
how they identified, located, and then seized the Qaddafi money; 

(c) The complete Qaddafi CINFIN file to which the State Department would have 
access; 


(d) Identification of the corporate vehicles created by the Qaddafi family to 
exfiltrate the funds. 
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If Mr. Blumenthal were able to obtain all of these records, it would then be possible for the team 
to perhaps succeed in tracing the funds to their present day location and use a legal team to 
commence seizure proceedings using the Moravia Writ legal method. The potential reward to the 
Blumenthal team would be tens of millions of dollars, but depended entirely on his ability to 
leverage his relationship with Mrs. Clinton. The plot was disrupted when the email server, and 
the memos (samples of which are found at Attachment #5) became 


The bottom line here was “No Data - No Dollars”, 
team’s efforts would be doomed. 


I^fent this political quid pro quo, the 


In addition to the above, the Phase I Study resulted in some other detailed fillings that are best 
summarized below: 


l. 


2 . 


3. 


4. 


The computer of Sidney Blumenthal was positively identified as hosting nyniy emails and attachments 
originating from Hillary Clinton's server and others from the Cllutoiyfroundation. In Phase I, we 
recovered at least 20 memos from Mr. Blumenthal to Mrs. Clinton tlyft contained Situation Reports ^ 
(SITRKI’S) allegedly based upon intelligence sources in Libya. 

%; 

Mr. Blumcnthal's server was successfully aS®sSi«r;.t)y Marcel La/yf I.chel, originally fronj^Bucharcst, 
who is also known as Guccifer or “Small Fu^T- ‘ii 

While one spreadsheet shows that files were fotofd on : ascloscd>M(crypted and password 

protected site of someone other thar fee, only a full analysis of tlw^rjSrcadsheet will reveal all of 
the files traced back to Mrs. Clinton's server directly, or lb that o£>lrT Blumenthal. These files were 
traced to a computer that was using au application to access thcJPCcr-to-Pcer networks. The computer 
was traced to IP address 84.232.210.154, which points toTOupkarcsf, Romania. 

One search revealed that data thal ^ra jaK/d.iC .y'Mr, Blumenthal’sservcr was transferred to the 
computer at 84.232.210.154 on July;*" 1 (Bucharest Time), and yielded many references to 

“HRC” within the spreadsheet. Ti«? K-r^est that the content of the computer traced to IP 
84.232.210.154, was not .Guccifer, Kwho accessed his server. The reason is that this 
“migration" occurred long yfes-tsentified, arrested, and incarcerated in Romania. 

Several possible etplanatiops'exist: (a) Guccifer had a co-conspirator that continued to operate the 
collection from variouj^Kfurces as a “get out of jail free card"; (h) The computer doing this collecting 
did belong to Gucpifer, M\A he alkiwed/it to run long after lie was arrested. This scenario seems 
unlikely for ajxfmber of technical reasons. i>) This computer belongs to a foreign service or someone 
else who ^wricked the Guccifer server Anti transferred the data to computer 84.232.210.154. 


5. 


ithstanding the above, data from hot : i,/w blumenthal computer and the Clinton email server 
'migrated to Guccifer, and then lb a cdmptaW &«» to IP 84.232.210.154, both of which were located 
: Outside of the United States auu outside of itrol of the US Intelligence Conipjwnity. Assuming 

either contained overtly classified data or retrospectively classified data, this is a major 

Counterintelligence conCcnwnd of interest to the Community. 

6. Guccifer entered:the Blumenthal computer several times, first through Blumenthal's AOL account. It 
is not clear whetheri:42irct#i»r targeted Blumenthal because lie represented an opportunity of interest, 
or because a foreign Jfcrvlcc directed him to the account. Also, it is not clear whether the account was 
entered after he firs/entcred the Clinton server or that of someone else on the Clinton domain server. 


7. During Phase Ilyfnuch additional information can bs obtained on the sequence, timing and chronology 
of when the twi/servers in question wen acqestqd sad sn wSiet ordes- and how many times. 

8. We found indications that Guccifer or er aciihg on his behalf or persons impersonating 

Guccifer did a secondary penetratiovo5IMfs)Cfirit£jj’? servey ett'&lay 22, 2009, and other penetrations 
thereafter. 

9. We confirmed that Guccifer used as aK^omo^a ampr W Russia to conduct the penetration, 

and therefore, there is a high possibility tflist life fl.&nian services that monitor these anonymous 
servers likewise have a copy. 
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10. One file that was found on Mrs. Clinton's server was not found on the Blumcnthal server. This file 
represents a major loss to the Intelligence Community because it appears to be targeting data. The 
data is first in Russian and then converted to Arabic. It represents a list of targets that quite possibly 
was created by a Russian source, located or intercepted by our services, and transmitted to Mrs. 
Clinton by some unknown person. The file then left her server and was found in the Deep Web and 
Dark Web. 

11. The above cited file, an excel spreadsheet, we assess, would enjoy the highest level of classification if 
submitted to a person who has original classification authority. The file was found stripped of its 
collars (if they ever existed). If it is determined by the FBI that this file ever was overtly classified, it 
will serve as a potential “smoking gun document.” 
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12. Guccifer penetrated a number of targets and we recovered over 37,000 files from a ifeinputcr traced to 
IP 84.232.210.154 that he obtained. We created a mapping of those files as tr^W’appear in the Deep 
Web. We then tested the spreadsheet and the content behind the spreadshee t''-: 37,000 files) using 
key word fuzzy logic. We confirmed the following Blumcnthal memos wt-$rai*s>nd on the Clinton 
Server and vice versa: 


Y^Sr*. complete copy of the Bliimenthal mcmos scut to Mrs. Clinton were opened recovered in original 
format and deserves critical analysis by counsel. Most all were word documents and related to a 
||i' number of issues. These can bt provided to counsel as a means to substantiate the claims of Guccifer. 

14. We did not actually cofuct the content of Mrs. Clinton's server or the content of computer 
84.232.210.154 tjt Phascl) we merely validated the major premise and hypothesis that data originating 
from either or both ofiAhe Clinton and Blumcnthal servers were attacked, directly or indirectly, and 
then were moved ouhide of the US to Guccifer, and then migrated to computer IP 84.232.210.154, 
owned and operate/by unknown persons. Additional research is required to cull through the 37,000 
files found to scleof those that pertain to Mrs. Clinton and which came directly from her server. 

15. We note that there arc profound legal questions regarding Phase II because it is not clear what our 
obligations may be regarding recovery of potentially classified data that may or may not contain actual 
collars that overtly show the content was classified at the time they were sent to Mrs. Clinton; or emails 
and attachments that were retrospectively classified but were released in truncated form. Our 
recovery of such content would be untruucatcd and in original condition. 


16 . 


It is conceivable that one possible motive for Mr. Blumcuthal’s decision to feed Mrs. Clinton the 
SI TREP reports was to promote his group as a quality private intelligence group in Libya capable of 
obtaining detailed intelligence from various unnamed, disparate sources as to the thinking, actions, 
planning and intentions of key operators in the region. We do not opine on the accuracy of the 
intelligence provided, only the tone and intent of the memos. Our assessment is that they are 
essentially, crafted as “shake and bake” intelligence assessments, done to promote a need by the 
Blumcnthal group, and not to turnover information because of some legal or moral obligation. 
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c evidence to indicate that a person identified as 



tclcphond \circa. 10 J 

anuary JU1J) began 


to s^list Senior Intelligence Analysts with experience in repatriation of assets plundered by 
the Qadritefi family. This person began the solicitation process on approximately January 
25" 1 2012, claiming that he led was dealing with representatives of a “high level political 
types in the US within the State Department” and that he personally had high level contacts 
within the new Libyan Opposition Government that he would have a contract with to begin 
the repatriation process. 


18. 


_ |has a rather con troversial history within the US Intelligence Co mmunity. 

particularly a ^ | His links to | / [ was one of 

the prime operatives in Libya. Notwithstanding his reputation in th/US Intelligence 
Community, he was believed to have highly placed contacts within LibyA which could have 
v>een mined for creation of a Rogue Nation Asset Recovery prograny; but for his limited 
technical and intelligence analyst resources. 


Phase If 


The proposed Phase II study includes: 


1. Recovery and sorting of all Guccifer data on the server in^Romania, to obta 
came from Mrs. Clinton's server as well as Mr. Blumcnthal’s server. 


'all data that 


2. Analyze all of the content of the computer IP 84.232-el0.15<L)>iWch appears to be different 
from the Guccifer server, although both apparcntl/are toedfed in the Bucharest, Romania 


area. 


3. Guccifer claims in recent reports that thejpefZt server contalns^bont 2 Terabytes <rf. sSata 
and represents all of his hacking ;effortarVKft opine this statcmtlif. is most likely accurate. 
The spreadsheet that we obtaincjj^nich Utaps the secret Speyer subsfcunidates the* dsiSm, 
assuming a portion of it originated from ttyc Guccifer server. 

4. The Clinton smokim^gtih data documgft to be mapped back 8o to servo t® ae.kf: the 
clear conncction^Vmch has not becn^mi^t<iniy established. 

5. The Headdress and email addresses of Mrs. Clinton and her colleagues who used this server 
iicptHo be checked to determinywhether any content traced back Go the server rr The email 
{ddress can be recovered fron/the Deep Web and the Dark Web sources to which we have 
access. 

6* The recovered data content needs to be date stamped and placed in a chronological arc to 
triangulate against the activities of Mrs. Clinton, particularly around the time when she was 
dealing with the Benghazi investigation. 

7. Counsel needs to determine from quality counsel with National Security experience and 
intelligence experts, the legal obligations by cleared persons to report and surrender data 
that msiy have overtly labeled classified data; or data that would objectively be considered 
classified hadiji been hypothetically subjected to a person possessing original classification 
authority. 
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Serial U of Originating Document_ _ SH 
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Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 
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Federal Taxpayer Information (FTI) ^ 

□ Yes [^Ctoo 
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ALL FEI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 12-01-2016 BY J76J18T80 HSICG 


Monica Hanley V s AfofkZvA ' 

• Why did you create the email aicrtive? SPRING 2013 

o Confirm date of creation [believed to be March 2013. In addition, we see HDR22 
accessing mailbox from a Mac from 3/23/13 - 4/1/13.] 
o Why both a laptop computer and a thumb dri ve? 


o Who instructed who to create ft? 


o Who helped her create the archive? Did^pu work with Bryan P agliano or Justin 


* i * - r 

Cooper to create the archive? [[previously-raenfioned 
frame] 


- wrong time 


o Who gave you the login credentials/paSsWord for HDR22? 


o Was that the first time you logged in to the mail account? If not, explain. 


o Did anyone else ever log in to her mail account (Huma, etc.)? 
o Did you access the mail using the Macintosh Mail application or via webmail? 


o How did you create the archive? How did you save it (i.e., files on your laptop, 
thumb drive, CD, kept in the Mail app)? Where did you save it? 


o Did you, or someone else, delete any emails from Clinton’s active mailbox after 
this transfer was completed? 

o Did Clinton change her address from hdr22@clintonemail.com to 
hrodl7@clintonemail.com before OR after the archive was created? 

o Who, if anyone, had access to the laptop until you sent it to PRN? 

■ Did anyone request access? 


o After you downloaded the emails to the laptop, did you use the laptop? 
o After you downloaded the emails to the laptop, did you ever access the emails? 


• Do you remembei[ 

' o 


[showing you how to access this archive remotely? 


What did this archive look like? On what computer did you access this archive? 
o Do you recall the steps? The password/login credentials? 
o Did you provide these credentials to anyone else? 


• From where did you purchase Clinton’s BlackBerry devices? 

• What source document did Clinton use to write her State memoir. Hard Choices ? 
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ALL FBI INFORUATICN COHTAINED 

HEREIN IS UNCLASSIFIED 

CATE 12-01-2016 BY J76J18T80 NSICG 


b6 

b7C 


Monica Hanley ^ • Ut *,i rfc^ 7 

• Why did you create the email archive? SPRING 2013 

o Confirm date of creation [believed to be March 2013 . In addition, we see HDR22 
accessing mailbox ffonja from 3/23/13 -4/1/13.] 

o Why both a laptop thumb drive? 


b6 

b7C 


o Who instructed who 


Who helped her create the archive? Did you work w ith Bryan P agliano or Justin 
Cooper to create the archive? [previously mentioned - wrong time 

frame] 


b6 

b7C 


Who gave you the login creds&%ls/password for HDR22? 'f- Htw d-id ^(TVC- 

(xcuU -pK' 

a&cvun t - 


o Was that the first time you 



in to the mail account? If not, explain. 


o Did anyone else ever log in to her mail account (Huma, etc.)? 

o Did you access the mail using the Macintosh Mail application or via webmail? 

o How did you create the archive? How did you save it (i.e., files on your laptop, 
thumb drive, CD, kept in the Mail app)? Where did you save it? 



Did you, or someone else, delete any emails from Clinton’s active mailbox after 

this transfer was completed? be-frrt ■ 

Did Clinton change her address from hdr22@clintonemail.com to 
hrodl7@clintonemail.com before OR after the archive was created? 


Who, if anyone, had access to the laptop until you sent it to PRN? 
■ Did anyone request access? 


o 

o 


•hhc-r-d was [\ 
frcd. In 
aft 7 

After you downloaded the emails to the laptop, did you use the laptop? ? 

After you downloaded the emails to the laptop, did you ever access the emails? 


Do you remembei[ 


Showing you how to access this archive remotely? 




o 

o 


What did this archive look like? On what computer did you access this archive? 
Do you recall the steps? The password/login credentials? 

Did you provide these credentials to anyone else? 


@ f 


b6 

b7C 


i ^7 

From where did you purchase Clinton’s BlackBerry devices? ATTC-nr/] tA* . 


• What source document did Clinton use to write her State memoir, Hard Choices '? 

prtAfo j Cua-£ A{y\&v] cttfUib (>aajllIs 

ujj |cm^ ]^\\crc -faUc dhncf • 
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rn-340 (Rev. 4-11 -031 

File Number 




Field Office Acquiring Evidence . 
Serial ft of Originating Document 
Date Received - \ - 2 .0 1 (fi 
From 


Wr 






+Wl£t 


;ontnbulor/lnlcrviewce) 


b3 

b7E 


b6 

b7C 


(Address) 


(City and Slate) 



To Be Returned □ Yes 

Receipt Given D Yes D^No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 


□ Yes 

Federal Taxpayer Information (FTI) 

□ Yes 






Reference: ft I 

(Communicalion Enclosing Material) 


b6 

b7C 


b6 

b7C 


Description: ^ Original notes re inte rview of 

f-Avi a-iK b-c-h/Wm Hua teo|, 4_ _ 


b6 

b7C 


HRC-2240 





ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 12-01-2016 BY J76J18T80 NSICG 


From: 

Sent: 

To: 

Cc: 

Subject: 

Attachments: 


WF) (FBI) 


b6 

b7C 



2016 1:04 PM 
F) (FBI) 


Email 10.9-2013.pdf; Hanleyf 


^mails _ 

Email 2.10.2014.pdf , Hanley 
23.2013. pdf; HanlevT 


"tmail 10. 


lEmail 2.11.2014.pdf; 


Email 10.7.2013.pdf; Hanley 
6.2013.pdf 


Dear Speci al Agen{ 


|as requested, attached are copies of Ms. Hanley's email communications with j 
| related to the laptop/email archive matter. Please let us know if there is anything else you r equire. 
apologize for the delay in sending this, but I was out of town earlier this week and just returned today. 


b6 

b7C 


b6 

b7C 


Iwashin oton. DC 20001-4412 


3 


1EL 


Download V-Uard I View Biography 

I 

CONFIDENTIALITY WARNING: This email may contain privileged or confidential information and is for the sole use of the intended recipient(s). Any unauthorized 
use or disclosure of this communication is prohibited. If you believe that you have received this email in error, please notify the sender immediately and delete it 
from your system. 

I > 


1 


HRC-2241 





Gmail - HRC emails 


M Gmail 


HRC emails 


_ tt „kttj»^?S8iQ5^si^n/mail/ii/0/?ui=2&ik=cb482b6546&view=pt... 



~S r b—,- r m n n~ <Vrir4lT 


20 messages 



which requires sending all of her archived email to your server. You recall that we couldn’t figure out a way for you 
to connect to the laptop that I have in my possession. 


b6 

b7C 


Do you have time to try tomorrow? Last time, I tried from HRC's home but tomorrow I can try from my home, 
which has good wifi. 

I'm addin g fr or her situational awareness ] | as soon we've transferred the email, I'll figure out a way 

to get the wiped laptop to you. 

best, 

Monica_ 


To: Monica Hanlevl 
Cc ] 


Jggmail. 


com> 



Mon, Feb 10, 2014 at 9:02 PM 


b6 

b7C 


I should be able to work with you on this tomorrow morning, can we shoot for around 11a EST? 


From: Monica Hanley [mailtc£ 


Se nt: Monday, Febru ary 10, 2014 8:55 PM 

To] ' 

Cc 


Subject: HRC emails 

[Quoted text hidden) 


b6 

b7C 


This email has been scanned for email related threats and delivered safely by Mimecast. 




Gmail - HRC emails 


£ i i!IPSi.‘/-'naiU^6ogle.com/mail/u/0/?ui=2&ik=cb482b6546&vievv=pt... 


For more information please visit http://www.mimecast.com 


M onica Hanleyf 

To| 

Cc 


mail.com> 


Mon, Feb 10, 2014 at 9:03 PM 


sounds great 

if tomorrow falls through for you, we can find another time. Will email you in the morning. 
[Quoted text hidden] 


M onica Hanley I 

T 4 

does this morning still work for you? 
[Quoted text hidden) 



Tue, Feb 11, 2014 at 11:00 AM 


To: Monica Hanleyf 
Sure thing 


Tue, Feb 11, 2014 at 11:08 AM 


b6 

b7C 


b6 

b7C 


b6 

b7C 


Can you fire up the Mac that has the emails on it, and go to tttly^ifeftfe'- from that Mac ? 
https://broker.gotoassist.com/h/citrixassist?Question^Df#. # ( , -Z^? : -'392 


From: Monica Hanley [mailtc j 

Se nt: Tuesday, Februar y 11, 2014 11:00 AM 

To | 

Subject: Re: HRC emails 

[Quoted text hidden] 

[Quoted text hidden! - 


Monica Hanleyf ~| Tue, Feb 11,2014 at 11:11 AM 

To| 

done! let me know if you can see the screen 
[Quoted text hidden] 


b6 

b7C 


b6 

b7C 


Tue, Feb 11, 2014 at 11:11 AM 


b6 

b7C 






Gmail - HRC emails 


https://mail .google.com/mai l/u/0/?ui=2&ik=cb482b6546&view=pt... 


To: Monica Hanley 


Monica, I can see your screen now. Can you call me real quick? 


b6 

b7C 


From: Monica Hanley [mailtoj_ 

Se nt: Tuesday, Februan /11, 2014 11:00 AM 

To l I 

Subject: Re: HRC emails 


b6 

b7C 


does this morning still work for you? 

[Quoted text hidden] 

[Quoted text hidden) 


M onica Hanley! 

T 4 


r -r ;——- 

Tuo^Feb 11 2014 at 11:18 AM 




b6 

b7C 


[Quoted text hidden] 


— ■ — .‘-r-i - 


To: Monica Hanle 




-“t(fe;F<te"1fy20l4 at 12:28 PM 


b6 

b7C 


Monica, my remote session disappeared, maybe the laptop went into sleep mode? 


From: Monica Hanley [mailtcj_ 

Sent: Tuesday, February 11, 2014 11:18 AM 

[Quoted text hidden] 

[Quoted text hidden] 

[Quoted text hidden] 


b6 

b7C 


m on| | _ 

Toj 

will check I'm out but headed back to the apt now 
[Quoted text hidden] 


Tue, Feb 11, 2014 at 12:34 PM *>6 

b7C 


- 1 

Tue, Feb 11, 2014 at 12:34 PM 

b6 

To: monj 


b7C 


No worries, let me know when you cg-VgSs? back over there to power it up 


3 of 6 


6/23/16,3:29 PM 

HRC-2244 



Gmail - HRC emails 


https://mail.google.com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


From: mon [mailto|_ 

Sent: Tuesday, February 11, 2014 12:34 PM 

[Quoted text hidden] 

[Quoted text hidden] 

[Quoted text hidden] 


b6 

b7C 


M onica Hanley f 

To ] 

i'm home now 

should i dick on the same link that you sent this morning? 
[Quoted text hidden) 



Tue, Feb 11, 2014 at 12:56 PM b6 

b7C 


[ 


To: Monica Hanle£ 


Tue, Feb 11,2014 at 12:59 PM b6 

b7C 


I'll have to send you a new one, standby 


From: Monica Hanley [mailtcjj 


Sent: Tuesday, February 11, 2014 12:57 PM 

i tQuarwi Ivixi riia.*n] 


b6 

b7C 


To: Monica Hanle 


l 


Tue, Feb 11,2014 at 12:59 PM 


b6 

b7C 


https://broker.gotoassist.co m/h/citrixassist?Question=DR960-073-880 


From: Monica Hanley [mailto] 

Sent: Tuesday, February 11, 2014 12:57 PM 

[Quoted text hidden) 

[Quoted text hidden) 

[Quoted text hidden) 


b6 

b7C 


To: Monica Hartey 


Tue, Feb 11,2014 at 1:03 PM 


b6 

b7C 
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6/23/16,3:29 PM 

HRC-2245 



Gmail - HRC emails 


https://mail.google.com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


I am back in, thanks. 


I am still having problems connecting to the server. I am enlistin 
should be sending me some screenshots soon 


g | h elp since he has a similar setup, he 


b6 

b7C 


• From: Monica Hanley [mailt j | 

Sent: Tuesday, February 11, 2014 12:57 PM b7 ' 

[Quoted text hidden] 

(Quoted text hidden] 

[Quoted text hidden] 


To: Monica Hanleyj 

Cc l „ 



Hi guys - just following up on this. Let me know when the wiped laptop is ready to 
it to the foundation at: 


Tue, Mar 25, 2014 at 4:42 PM 


be shipped. □ best to send 


Hi llary Rodham Clinton 

H _ i 

1271 Avenue of the Americas 

42nd Floor 

New York, NY 10020 

Let me know once it's gone out so we know to expect it. Thanks, 



, Feb 10, 2014 at 9:03 PM, Monica Hanley 

text hidden] 


wrote: 


To : Monica Hanleyf 

C 1 



Just checking back on this j [ s it still with you? Thank you, 
[Quoted text hidden] 


Fri, Apr 4, 2014 at 10:09 AM 


.To 


j5)gmail.com>, Monica Hanktyf 


Fri. Aar 4. 


2014 at 10:11 AM 


Sorry, missed this the first time around. Yes, the email has ijsKtn jrSJKjirted into an archive mailbox on the 
server, and I can send the mac back to you soon 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


From 


Jggmail.com] 


b6 

b7C 
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https://maiI.google.co m/mail/u/0/?ui=2&ik=cb482b6546&vie\v=pt... 


Sent: Friday, April 04, 2014 10:10 AM 
To: Monica Hanley 

Cc \ ] 

Subject: Re: HRC emails 


b6 

b7C 


Just checking back on this ] | is it still with you? Thank yot| 

[Quoted text hidden] 

[Quoted text hidden] 


Monica Hanle 1 

To 

C4 




? 


J$gmail.com> 


Sat, Apr 5, 2014 at 11 54 AM 


I know I don’t work with you an ymore so no need to reply to me but if HRC w ants a ccess to her email, can she 
now access it through the web? | \ I think you should update Huma anc ^ fc in where all of her old email is. 


b6 

b7C 


[Quoted text hidden] 


To. Monic a Hanl ey I 

Cel 




gmail.com> 


makes sense! would love the details - thanks! 
[Quoted text hidden] 


Sat, Apr 5, 2014 at 1:55 PM 


b6 

b7C 
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6/23/16,3:29 PM 

HRC-2247 




Gmail 


address 


https://maiI .google.com/mail/u/0/?ui=2&ik=cb482fc"§?‘-46&vicw=pt... ^6 

: v #b" b7c 


|^1 Gmail 


address 


5 messages 

... =i--b6 

__|_ Tue, Feb 11,2014 at 3:23 PM b7 , 

To: "Monica Hanleyl I 


Here’s my home address where I work from: 


Monica Hanley 


b6 

b7C 


This email has been scanned for email related threats and delivered safely by Mimecast, 
For more information please visit http://www.mimecast.com 



T °l 


finally sent this out so u will receive tomorrow, 
tracking nu mber is 8046 1373 3770 
pw is either ^ ~| 

let me know if you need anything and thanks! 
[Quoted text hidden] 


Mon, Feb 24, 2014 at 11:29 AM b6 

b7C 


• ,_J 

Mon, Feb 24, 2014 at 11:40 AM 

To: morj 



b£ 

b7C 


Thanks! 


From: mon [mailtof 


Sant: Monday, Febru ary 24 

■m- : 1 


2014 11:29 AM 


Si»sas.ct: Rej_ 


ress 


b6 

b7C 


1 of 2 


6/23/16,3:28 PM 

HRC-2248 




Gmail 


address 


https://mail.google.com/mail/u/0/?ui=2&ik=cb482b6546&vicw=pt... b6 

b7C 


[Quoted text hidden] 
[Quoted text hidden] 


To: mor[ 


Tue, F®b 2$, 2814 at 1:22 PM 


b6 

b7C 


Monica, I received the laptop, I will put some time on my calendar this week to get the email exported and put 
onto the server. Best of luck in your n^xt job! 


From: mon [mailtc j 
Se nt: Monday, Febru ary 24, 2014 11 


T °! -, 

Subject: Rq 


9 AM 


^address 


b6 

b7C 


finally sent this out so u will receive tomorrow. 

[Quoted text hidden] 

[Quoted text hidden] 


mo 

To 


terrific, thank you! 
[Quoted text hidden] 


Tue, Feb 25, 2014 at 2:02 PM b6 

b7C 


2 of 2 


6/23/16,3:28 PM 

HRC-2249 



Gmail - HRC - time sensitive 


https://mail.google.com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


h'l Gmail 


Monica Hanley 


b6 

b7C 


HRC : time sensitive 

3 messages 


Mo ^ 

fWy-TpI 

To 


L 


Mon, Sep 23, 2013 at 8:14 PM 


" 1 - 3 . its rt^ki3 & I^E^Her berry got creamed. I'm o n my way out to buy a berry for her but are you avail to 
help with the estivation tonight? Pis let me know | | is my cell 


M onica Hanlevl ~] Thu, Oct 3, 2013 at 4:35 PM 


<C3 so we are going for the transfer tomorrow 

pw for enterprise activation is still the same as you told me on the phone? 

[Quoted text hidden) 



To: Mo 


mca 


Hanleyj^ 


I will set it again- it clears after each activation. It will b ^ [ again. 


Thu, Oct 3, 2013 at 4:37 PM 


b6 

b7C 


b6 

b7C 


b6 

b7C 


I'll be around tomorrow if you run into any problems 


From: Monica Hanley [mailtc j 

Se nt: Thursday, Octo ber 03, 2013 4:35 PM 

T ° l 

Subject: Re: HRC - time sensitive 
[Quoted text hidden) 


b6 

b7C 


1 of 1 


6/23/16,3:30 PM 

HRC-2250 



Gmail - HRC BB 


ht!ps://mail.google .com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


h’i Gmail 

_ 

HRC BB 

9 messages 


To: Monica Hanley^ 
Hi Monica- 


Monica Hanley] 


Mon, Oct 7, 2013 at 11:38 AM 


b6 

b7C 


b6 

b7C 


I take it everything went fine with HRC’s new blackberry, since we didn’t receive any calls/emails from you. Let 
me know if otherwise J 


b6 Per FBI, DOS 
b7C 


Mon£ 


Reply-Tol 

To [__ 


Wed, Oct 9, 2013 at 9:52 AM 


H 

Yes the enterprise activation went off without a hitch]_[did the switch. 

There are a couple of preference and apps that ) | can't figure out how to download (like a google search app) 
but I'll take a stab at it when I see her on Sunday. 

I have the laptop today and good wifi if you have time to do the email switchy-tranfer thing today. 



Date: Mon, 7 Oct 2013 15:38:47 +0000 
To: Monica Hanley| 

Subject: HRC BB 


b6 

b7C 


Hi Monica- 


I take it everything went fine with HRC’s new blackberry, since we didn't receive any calls/emails from you. Let 
me know if otherwise J 



Wed, Oct 9, 2013 at 9:54 AM 


b6 

b7C 


I’d like to set up a remote control session on the Mac- what email address would be best to send the link to, for 


1 of 3 


6/23/16,3:27 PM 

HRC-2251 




Gmail - HRC BB 


hups://mail.google.com/mai l/u/0/?ui=2&ik=cb482b6546&view=pt... 


you to get it on the archive laptop ? 


From: Mon [mailto:|_ 

Sent: Wednesday, October 09, 2013 9:53 AM 

To l 1 

Subject: Re: HRC BB 


(Quoted text hidden] 


Morj 


1 , 

: at 9:56 AM 

Rep 

v-Tol 

1 

• •» • • • • * " 

T°[ 


_ 1 

• it ii • *■ r 


This one ! . i ^ I 

Also, can we at some point today? 

- -- 

From l ^ *_' ' '■ 

D ate: Wed, 9 O~ct'20l3 13:54 25 +0000 

T ° l 

Subject: RE: HRC BB 

TQSptW text hidden] 


I Wed, Oct 9, 2013 at 9:59 AM 

Tol 



b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


We can reset HRC’s password anytime you'd like. You can either tell me what to set it to, or the more secure 
option would be to login to webmail, then click Options > Change password in the upper right corner of the 
webmail interface. Let me know if you need any help with that. 


Here's the remote control code for the archive laptop, please fire this up from the laptop and accept any prompts 
to open/run/download/ato Qnd we should get hooked up. The code is only goofor 30 min, so if you're busy and 
we need to delay this t- let me know when you're ready and I can generate a rteW one. * • * 


https://broker.gotoassist.com/h/citrixassist?Question=DR988-932-848 


i i t 


From: Mon [mailtcj^ 


Sent: Wednesday, October 09, 2013 9:57 AM 


[Quoted text hidden] 


b6 

b7C 
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6/23/16,3:27 PM 

HRC-2252 





Gmail - HRC BB 


https://mail.google.com/mail/u/0/?ui=2&ik=cb482b6546&vie\v-pt... 


[Quoted text hidden] 


Mor j I Wed, Oct 9,2013 at 10:00 AM *>6 

R eply-Tol I 

To l I 

Yes sorry won't be by wifi until 11am. Is that ok? 

From_ b6 

Date: Wed, 9 Oct 2013 13:59:40 +0000 b7c 

(Quoted text hidden] , 



Totally fine, send me another email when you're good to go 


Wed, Oct 9, 2013 at 10:03 AM 


b6 

b7C 


From: Mon[mailtJ 

Sent: Wednesday, October 09, 2013 10:01 AM 


[Quoted text hidden] 


[Quoted text hidden] 


Mojiica Hanley!_ 

To: 

Wed, Oct 9, 2013 at 11:15 AM 

ready! 


[Quoted text hidden] 



__ I Wed, Oct 9, 2013 at 11:17 AM 

To: Monica Hanley j | 

Here you go: https://broker.gotoassist.corn/h/citrixassist?Question=DR963-617-436 


b6 

b7C 


b6 

b7C 


b6 

b7C 


From: Monica Hanley [mailto| 

Sent: Wednesday, October 09, 2013 11:16 AM 

[Quoted text hidden] 

[Quoted text hidden] 


b6 

b7C 
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6/23/16,3:27 PM 

HRC-2253 



Gmail - Remote link 


https://mail.google.com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


M Gmail 


Monica Hanley 


b6 

b7C 


Remote link 

1 message 

— , 

To. Monica Hanley 


https://broker.gotoassist.com/h/citrixassist?Question=DR051^43gv752 


Wed, Oct 9, 2013 at 11:40 AM 


b6 

b7C 


1 of 1 


6/23/16,3:28 PM 
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Gmail - Computer 


https://mai I.google.com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


M Gmail 


Monica Hanley 


b6 

b7C 


Computer 

8 messages 


Wed, Oct 16, 2013 at 9:01 AM 

b6 
b7C 

I cannot get into my outlook. 

Keeps saying my name or pw isn't correct. Did they do something to our system? 


Monica Hanley l I _Wed, Oct 16,2013 at 9:11 AM *>6 

To: Huma Abedin <Huma@clintonemail.com> | | b7C 

not that i know of. 

Did you use this website? 
https://mail.clintonemail.com/owa 

Addin cj | to confirm. 

[Quoted text hidden) 



I ~1 Wed, Oct 16,2013 at 9:20 AM b6 

To: Monica Hanley l | Huma Abedin <Huma@dintonemail.com> b7C 


Hi Huma- Please let me know what method you are using to access your email (web, Outlook, mobile device, 
etc). Also please try your username/password on the site below from Monica. I can reset your password if 
necessary. 



From: Monica Hanley [mailto | 

Sent: Wednesday October 16, 2013 7:12 AM 
To: Huma Abedin; | ~| 

Subject: Re: Computer 

[Quoted text hidden] 


Huma Aheriin <Hnrna(ffirlintnnpmail mm> 

Wed. Oct 16. 2013 at 9:31 AM 


To:[- 



b6 

On the web using that site below. 

Keep getting same message 


b7C 

From 

mailtcj 


b6 


Sent: Wednesday, October 16, 2013 09:20 AM Eastern Standard Time 


b6 

b7C 
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6/23/16,3:27 PM 

HRC-2255 




Gmail - Computer 


https://mail.google.co m/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


To: 'Monica Hanley' |_ 

Subject: RE: Computer 


Huma Abedin 


[Quoted text hidden) 


1 _ Wed. Oct 16. 2013 at 9:41 AM 

To: Huma Abedin <Huma@clintonemail.corns ] 

Huma- I have set your password to not expire, please try again. If it still gives the same message, I will reset 
your password and you can change it to whatever you'd like 


b6 

b7C 


b6 

b7C 


From: Huma Abedin [mailto:Huma@clintonemail.com] 

Se nt: Wednesday, October 16, 20 1 3 7:31 AM : • 

To ] | bfi 

Subject: Re: Computer 

[Quoted text hidden) 


Huma Aheriin <;Hiima@rJintnnRmail nnm^_ Wed flnt Ifi ?f)13 at 9:42 AM 

To:| 

SUCCESS 
thank you! 


From: 

Sent: Wednesday , October 16, 2013 9:41 AM 
To: Huma Abedin] 

Subject: RE: Computer 

[Quoted text hidden] 


Huma Abedin <Huma@dintonemail.com> _ Wed, Oct 18, 2013 at 9:41 AM 



Not sure what you did but it works after 35 times of trying! 


b6 

b7C 


b6 

b7C 


b6 

b7C 


From: Huma Abedin 

Sent: Wednesday, October 16, 2013 09:31 AM Eastern Start&ffrf Time 


To: 

.“- 1 




Subject: Re: Computer" 


[Quoted text hidden] 


b6 

b7C 


2 of 3 



Gmail - Computer 


https://mail.google.com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 



b6 

b7C 


Great! I set your password to not expire, I think it had just run out of time. It won't do so again 


From: Huma Abedin [mailto:Huma@clintonemail.com] 
Sent; Wednesday. October 16.2Q13 1A1 AM_ 

H_ 

Subject: Re: Computer 


Not sure what you did but it works after 35 times of trying! 
(Quoted text hidden) 


b6 

b7C 


3 of 3 


6/23/16,3:27 PM 

HRC-2257 • 
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File Number 


Field Office Acquiring Evidence 
Serial # of Originating Document 
Date Received I 0 - J? ty-1 #o” 


- ffFifieo 


t°l 






ame ot Conlnnulor/inlerviewee) 


(City and State) 


To Be Returned U Yes SPNo 

Receipt Given D Yes t^^io 

Grand Jury Material - Disseminate Qkly Pursuant to Rule 6 (e) 

Federal Rules of Criminal Procedure 

□ Yes 2 £no 

Federal Taxpayer Information (FTI)^ 

□ Yes No 






Reference: OS 


_ ( H>) $ -jiqtW 

ammunication Enclosing Material) 


tr 3a « 


b7E Per DOS 


Description: [U Original notes re interview of 

PS (lu\ 4 i+-s,jL(sr) 


b7E Per DOS 








































ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 12-09-2016 BY J76J18T8D NSICG 



United States Department of State 
Washington, D.C. 20520 


©RftrNMJM 




FBI - 


FROM: DS/ICI/CI - 


t&seatei 


, i- -=,3T>~i=- 


SUBJEC r Iv|ffceipt of Files Transfer tor DS/ICI/CI Case PI-00-US-15-57 

This .memo .serv.es.as .a .transfer receipt from the Diplomatic Security 
Counterintelligence Division to the Federal Bureau of Investigations for the 
following items: 


b6 Per 
b7C DOS 


• j^monal files of b7c 

• '«®onal files of 

• Personal files of 

• Personal files of 

• Personal Files ol 

• Personal files of _ 

• Idatabase search results b7E per dos 
responsive to the October. 6 record request; and 

• Signed SF-312 forms responsive to the October 6 record request. 

'Signature below acknowledgesofthe -FBI: 



Date 


UNCLASSIFIED 


HRC-6304 
















ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 12-09-2016 BY J76J18T80 NSICG 


United States Department of State 

.5* : ‘i'iVv 

Washington, D.C. 2(0$2O 


October 15, 2015 

iSfeeRET7/ NOrORN> 

MEMORANDUM 



TO: 


DS/ICI/CI 


Investigations Division Chief 


THROUGH: 


DS/ICI/CI A 


NASA Section Chief 


S 

FROM: 


DS/ICI/CI A 


SUBJECT: 


PI-OO-US-15-57 

FBI 811 request for Production of Records: 


b6 Per 
b7C DOS 


j^NF^On 06 October 2015, DS/ICI/CI received a request for DS/ICI/CI database 
records for 35 State Department records in. The information was requested to satisfy a 
Section 811(c) that received from the Inspector General of the Intelligence 

Community. 


bl Per Dos 
b6 Per Dos 
b7E Per Dos 


^TNF^-In furtherance of this investigation DS/ICI/CI was able to find records in | 

;Si | Ifor 16 of the 35 subjects. The employees 

i. t . h . r e. cords _ fpu n d .wed__ 


#%7NF).A special note: 


DS/I CI/CI was only able to find five signed SF-312 forms from the October 6, 
2015 addition;! 


DS/ICI/CI has attacijijfi all of the found records from the employees. 


APPROVED 




DISAPPROVED: 


annual A nd Date) 


(Initial and Date) 


IS) 


b6 

b7C 


b6 Per 
b7C DOS 


b6 

b7C 


b6 Per 
b7C DOS 


(Classified by 



7 NOFORN - 

iBnvislonn CMeff BS/ICI/CI 


Measoim: L4c; Bedassnfy: 10/15/2040 


HRC-6305 






ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 12-09-2016 BY J76J18T80 NSICC 


HRC-6306 









BUREAU OF DIPLOMATIC SECURITY 


TITLE Counterintelligence Debrief ings of U.S. 
Employees, American Embassyl 


bl Per DOS 
b6 Per DOS 
b7C Per DOS 


CASE CLASSIFICATION 


FIELD OFFICE 

DS/CMI/CI(EEY) 

SYNOPSIS [ 


DATE REPORTED 

08/25/93 


DATES INVESTIGATED REPORTING AGENT 

Since 1/1/92 


_| During CY 1992, approximately bl Per dos 

48 employees departed post after completing a permanent change 
of station or a temporary duty assignment. The employees 
interviewed represented various U.S. government civilian and 
military agencies, and they were either interviewed by Special 
Agents of the Diplomatic Security Service or by Security 
officials of the other U.S. government agencies. Reports of 
of interviews are normally required, and copies are to be sent 
to the Regional Security Officer at the employees* last post. 

In addition to conducting the interviews, DS/CMI/CI officers 
tracked the employees to their new assignments (when possible) 
to insure that debriefings were completed. If information 
requiring additional investigation or follow-up was developed 
this office made every effort to see that it was done. 

Developed leads were forwarded to RSOs, other Federal agencies 
and other interested parties. All reports, related letters, 
memoranda, and correspondences are filed in the case file. 

Attached to this form is a list of the employees who were 
tracked and interviewed. This case is considered closed. 


- CLOSED - 


REFERENCE: 




DO HOT WRITE IS THIS SPACE 


Date Received 


Oripinai . nc■ 
(S) COPIES REFERRED 1 - 

REVIEWED BY AGENT SUPERVISOR 


U/CI 


bl Per DOS 


b€ Per 
b7C DOS 


bl Per DOS 


(Date) 


(Initials) 


50249-101 



(Formerly DS-838) 
OPTIONAL FORM 249 
MARCH 1975 
DEPT. OF STATE 


HRC-6331 





United States Department of State 
Washington, D. C. 20520 

March 15, 1993 


• CONFIDEN TIAL 

MEMOR ANDUM 


TO: 

FROM: 
SUBJECT: 


DS/CMI/CI - Mr. |_| 

ICS - John J. Stein ^ 

SY-56-RS-92-151 (Missing Classified) 
Request to Close Case File 


b6 Per 
b7C DOS 


92 Moscow 35238 advised that several confidential documents 
were missing from the files of political officer 

I Subsequent investigation by DS/CR/SI and RSO b6 

Moscow indicated that the documents probably asvet left the b7c 

core, and the political section damage assesytyrslat indicated 
that the documents may : hay®.-been inadvertently shredded. 

DS/CR/SI considers closed. Consultations with 

DS/CR/SI and a review a®;|^:/'ttase papers did not surface 
anything of Cl interest;' '<? ■ 

No further Cl action Request case be closed. 


APPROVE 

I 


DATE: 



DISAPPROVE. 


CONFIDENTIAL 


Drafted 


DECL:OADR 


b6 Per 
b7C DOS 





ALL FBI INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 12-09-2016 BY J76J18T80 NSICG 



United States Department of State 
Washington, D.C. 20520 


MEMORANDUM 


October 15, 2015 


TO: 

THROUGH: 

FROM: 

SUBJECT: 



PI-OO-US-15-57 

FBI 811 request for Production of Records: 


$S#NF) On 06 October 2015, DS/ICI/CI received a request for DS/ICI/CI database 
records for 35 State Department records in. The information was requested to satisfy a 
Section 811(c) that the FBI received from the Inspector General of the Intelligence 
Community. 

>S//NF)-In furtherance of this investigation DS/ICI/CI was able to find the employee 
records for 16 of the 35 subjects. The employees with records found were] | 


A special note 


DS/ICI/CI was unable to fi nd any signed SF-312 forms for everyone on the 
October 6, 2015 addition except for] 


DS/ICI/CI has attached all of the found records from the employees. 





b6 Per 
b7C DOS 


b6 

b7C 


b6 Per 
b7C DOS 


b6 

b7C 


APPROVED:_ 

(Initial and Date) 


DISAPPROVED:_ 

(Initial and Date) 


^gg€$fcgX7 7NQ]FOiRN 


Division Chief DS/ICI/CI 


Reason: 1.4c; Declassify: 1 ©/l5/204(0) 


b6 Per 
b7C DOS 


HRC-6370 




HRC-6371 



CLASSIFIED ^FORMATION NONDISCLOSURE AGREEMENT 


AN AGREEMENT BETWEEN 


AND THE UNITED STATES 


(Name of Individual - Printed or typed) 


1. Intending to be legally bound, I hereby accept the obligations contained in this Agreement in consideration of my being granted 
access to classified information. As used in this Agreement, classified information is marked or unmarked classified information, 
Including oral communications, that is classified under the standards of Executive Order 12958. or under any other Executive order or 
statute that prohibits the unauthorized disclosure of information in the interest of national security; and unclassified information that 
meets the standards for classification and is in the process of a classification determination as provided in Section 1.1, 1.2 13 and 
1.4(e) of Executive Order 12958, or under any other Executive order or statute that requires protection for such information in the 
interest of national security. I understand and accept that by being granted access to classified information, special confidence and 
trust shall be placed in me by the United States Government. 

2. I hereby acknowledge that I have received a security indoctrinaCor. learning the nature and protection of classified information 
Including the procedures to be followed in ascertaining whether other persons to whom I contemplate disclosing this information have 
been approved for access to it, and that I understand these procedures. 


b6 

b7C 


3. I have bom Wivised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified information by me 
could cause or irreparable injury to the United States or could be used to advantage by a foreign nation. I hereby agree that I 

will never divyfg* russified information to anyone unless: (a) I have officially verified that the recipient has been properly authorized by 
the United States Government to receive it; or (b) I have been given prior written notice of authorization from the United States 
Government Department or Agency (hereinafter Department or Agency) responsible for the classification of information or last granting 
me a security clearance that such disclosure is permitted. I understand that if I am uncertain about the classification status of 
information, I am required to confirm from an authorized official that the information is unclassified before I may disclose it, except to a 
person as provided in (a) or (b), above. I further understand that I am obligated to comply with laws and regulations that prohibit the 
unauthorized disclosure of classified information. 


4. I have been advised that any breach of this Agreement may result in the termination of any security clearances I hold; removal from 
any position of special confidence and trust requiring such clearances; or termination of my employment or other relationships with the 
Departments or Agencies that granted my security clearance or clearances. In addition, I have been advised that any unauthorized 
disclosure of classified information by me may constitute a violation, or violations, of United States criminal laws, including the 
provisions of Sections 641, 793, 794, 798. *952 and 1924, Title 18. United States Code, ‘the provisions of Section 783(b), Title 50, 
United States code, and the provisions of the intelligence Identities Protection Act of 1982. I recognize that nothing in the Agreement 
constitutes a waiver by the United States of the right to prosecute me for any statutory violation. 

5. I hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result or may 
result from any disclosure, publication or revelation of classified information not consistent with the terms of this Agreement. 

6. I understand that the United States Government may seek any remedy available to it to enforce this Agreement including, but not 
limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. 

7. I understand that all classified information to which I have access or may obtain access by signing Sfe•Aqtws^ssnt is now and will 

remain the property of, or under the control of the United States Government unless and until other***- by an authorized 

official or final ruling of a court of law. I agree that I shall return all classified materials which have, or R«sy piwstfsntu'my possession or 
for which I am responsible because of such access: (a) upon demand by an authorized repr^iaiste W the United States 
Government; (b) upon the conclusion of my employment or other relationship with the Department w Att&ttey fat last granted me a 
secunty clearance or that provided me access to classified information; or (c) upon the conclusion "of my employment or other 
relationship that requires access to classified information, if I do not return such materials upon request, I understand that this may be 
a violation of Sections 793 and/or 1924, Title 18, United States Code, a United States criminal law. 

8. Unless and until I am released in writing by an authorized representative of the United States Government, I understand that all 
conditions and obligations imposed upon me by this Agreement apply during the time I am granted access to classified information 
and at all times thereafter. 


9. Each provision of this Agreement is severable. If a court should find any provision of this Agreement to be unenforceable, all other 
provisions of this Agreement shall remain in full force and effect. • . 


■ u i . ' • > 

••• 
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10. These restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights or 
liabilities created by Executive Order 12958, Section 7211 of Title 5, United States code (governing disclosures to Congress); Section 
1034 of Title 10, United States code, as amended by the Military Wb,sfeblcwe r Protection Act (governing disclosure to Congress by 
members of the military); Section 2302(b) (8) of Title 5, United States Cods, as amended by the Whistleblower Protection Act 
(governing disclosures of illegality, waste, fraud, abuse or public hearth or safety threats); the Intelligence Identities Protection Act of 
1982 (50 U.S.C. 421 et seq.) (governing disclosures that expose confidential Government agents), and the statutes which protect 
against disclosure that may compromise the national security, including Sections S41,793, 794, 798, 952 and 1924 of Title 18 United 
State Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. Section 783(b)). The definitions, requirements, 
obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement 
and are controlling. 

11.1 have read this Agreement carefully and my questions, if any, have bear* answered: I acknowledge that the briefing officer has 
made available to me the Executive Order and statutes referenced in this agsmmu and its implementing regulation (32 CFR Section 
2003.20) so that I may read them at this time, if I so choose. 


DATE (mm-dd-yyyy) SOCIAL SECURITY NUMBER £>6 Per DOS 

,__J_ 02-03-2009 |_ 

3N (IF CONTRACTOR, LICENSEE. GRANTEE OR AGENT, PROVIDE: NAME. ADDRESS. AND F APPLICABLE FEDERAL SUPPLY CODE NUMBER! 

(Type or print) 1 


Circle one: GS FS PSC WAE Contractor Intern Other 


Bureau Assigned: 


. Telephone: ( ) 


WITNESS 


ACCEPTANCE 


■TUC iikincBciriic 

). 


BEHALF OF THE UNITFfl STATFi 



DATE (mm-dd-yyyy) 


ME AND 0 

r print) 

02-03-2009 

NAME AND ADDRESS'(Type or print) 


GOVERNMENT. 


b6 Per 






SA-20, IWISwIS/APD 
til>l North Lynn Street, 

■; ..Arlington, Virginia 22209 
,fB-f45-3066 


SA-20,13th fl.DS/lS/APD 
1801 North Lynn Street, 
Arlington Virginia 22209 
571-345-3066 






SECURITY DEBRIEFING ACKNOWLEDGMENT 

^. provisi °ns of the espionage laws, other federal criminal laws and executive orders applicable to the safequardinq of classified 
made ava !lf b e *° me: ,hat 1 have returned all classified information in my custody; that I will not communicate or transmit 
ifna^rfh^n° a !?Y UI ) aut ! 10r 'f® < 1 Person or organization; that I will promptly report to the Federal Bureau of Investigation any attempt by an 
unauthorized person to solicit classified information, and that I (have) (have not) (strike out inappropriate word or words) received a security debriefing 3 

SIGNATURE OF EMPLOYEE ~ ----- i -, AT _ . -—-— 

DATE (mm-dd-yyyy) 


NAME OF WITNESS (Type or print) 


[SIGNATURE OF WTNESS 


uninntanvfederal agencies inform individuals, at the time information is solicited from them, whether the 

' n ^'21n h?n r:' s 80,l P ,e 4 and what uses be made of the information. You are hereby 
9 y ° Soaal Se , cu . r L ty Nu , rnber < SSN ) is Executive Order 9397. Your SSN will be used to identify you precisely when it 
,0 t ,he information indicated above or 2) determine that your access to the information indicated has 

imP6de “ ie Pr0CeSSin9 ° ,Such certifica,ions determinations, 

‘*-*"-"*"*"—*1 wiOTr ^ tior ... ^_ 

rNQTA^MCABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT. - 
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1. Intending to be legally bound, I hereby accept the obligations contained in this Agreement in consideration of my being granted 
access to classified information. As used in this Agreement, classified information is marked or unmarked classified information, 
including oral communications, that is classified under the standards of Executive Order 12958, or under any other Executive order or 
statute that prohibits the unauthorized disclosure of information in the interest of national security; and unclassified information that 
meets the standards for classification and is in the process of a classification determination as provided in Section 1.1, 1.2. 1.3 and 
1.4(e) of Executive Order 12958, or under any other Executive order or statute that requires protection for such information in the 
interest of national security. I understand and accept that by being granted access to classified information, special confidence and 
trust shall be placed in me by the United States Government. 

2. I hereby acknowledge that I have received a security indoctrination concerning the nature and protection of classified information, 
including the procedures to be followed in aseeHffteng whether other persons to whom I contemplate disclosing this information have 
been approved for access to it, and that I unS^sfend these procedures. 

3 I have been advised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified information by me 
could cause damage or irreparable injury to the United States or could be used to advantage by a foreign nation. I hereby agree that I 
will never divulge classified information to anyone unless, (a) I have officially verified that the recipient has been properly authorized by 
the United States Government to receive it; or (b) I have been given prior written notice of authorization from the United States 
Government Department or Agency (hereinafter Department or Agency) responsible for the classification of information or last granting 
me a security clearance that such disclosure is permitted. I understand that if I am uncertain about the classification status of 
information, I am required to confirm from an authorized, official that the information is unclassified before I may disclose it, except to a 
person as provided in (a) or (b), above. I further understand that I am obligated to comply with laws and regulations that prohibit the 
unauthorized disclosure of classified information. 

4. I have been advised that any breach of this Agreement may result in the termination of any security clearances I hold; removal from 
any position of special confidence and trust requiring such clearances; or termination of my employment or other relationships with the 
Departments or Agencies that granted my security clearance or clearances. In addition, I have been advised that any unauthorized 
disclosure of classified information by me may constitute a violation, or violations, of United States criminal laws, including the 
provisions of Sections 641, 793, 794, 798, *952 and 1924, Title 18, United States Code, *the provisions of Section 783(b), Title 50, 
United States code, and the provisions of the intelligence Identities Protection Act of 1982. I recognize that nothing in the Agreement 
constitutes a waiver by the United States of the right to prosecute me for any statutory violation 

I hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result or may 
jsj&jlt from any disclosure, publication or revelation of classified information not consistent with the terms of this Agreement. 

6. I understand that the United States Government may seek any remedy available to it to enforce this Agreement including, but not 
limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. 

7. I understand that all classified information to which I have access or may obtain access by signing this Agreement is now and will 
remain the property of, or under the control of the United States Government unless and until otherwise determined by an authorized 
official or final ruling of a court of law. I agree that I shall return all classified materials which have, or may come into my possession or 
for which I am responsible because of such access: (a) upon demand by an authorized representative of the United States 
Government; (b) upon the conclusion of my employment or other relationship with the Department or Agency that last granted me a 
security clearance or that provided me access to classified information; or (c) upon the conclusion of my employment or other 
relationship that requires access to classified information. If I do not return such materials upon request, I understand that this may be 
a violation of Sections 793 and/or 1924, Title 18, United States Code, a United States criminal law. 

8. Unless and until I am released in writing by an authorized representative of the United States Government, I understand that all 
conditions and obligations imposed upon me by this Agreement apply during the time I am granted access to classified information, 
and at all times thereafter. 

9. Each provision of this Agreement is severable. If a court s^y^find any provision of this Agreement to be unenforceable, all other 
provisions of this Agreement shall remain in full force and effect 
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10. These restrictions are consistent with and do not iw'persade. oanSrt with-or btherwise alter the employee obligations, rights or 
liabilities created by Executive Order 12958, Section (governing disclosures to Congress); Section 

1034 of Title 10, United States code, as amended bj.sfefr ¥-.«wy -protection Act (governing disclosure to Congress by 

members of the military); Section 2302(b) (8) of T&f. S State;? .Cejie. ss amended by the Whistleblower Protection Act 

(governing disclosures of illegality, waste, fraud, abuse'W-itul^c;fiea. ! lh;of safetyihreats); the Intelligence Identities Protection Act of 
1982 (50 U.S.C. 421 et seq.) (governing disclosures teat ex?»se' ^fia^ai<5£fvernment agents), and the statutes which protect 
against disclosure that may compromise the national security., indyefeta 793, 794, 798, 952 and 1924 of Title 18, United 

State Code, and Section 4(b) of the Subversive Activities Act of 1^50 (56 U.S.C. Section 783(b)). The definitions, requirements, 
obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement 
and are controlling. 


11.1 have 
made availd 
2003.20) sd 



, if any, have been answered. I acknowledge that the briefing officer has 
renced in this agreement and its implementing regulation (32 CFR Section 

b6 Per DOS 


DATE (mm-da-yyyy) 


02-27-2009 


SOCIAL SECURITY N1IMRFR 

(See Notice below) j 


(Typeorphnt) 


ROVIDE: NAME, ADDRESS, AND IF APPLICABLE. FEDERAL SUPPLV CODE NUMBER) 


Circle one: GS FS PSC WAE Contractor Intern Other 

Bureau Assigned:_Telephoned ) 


WITNESS 


ACCEPTANCE 


THE EXECUTION OF THIS AGREEMENT WAS WITNESSED 
BY THE UNDERSIGNED. 


THE UNDERSIGNED ACCEPTED THIS AGREEMENT ON 
BEHALF OF THE UNITED STATE® GOVERNMENT. 


DATE (mm-dd-yyyy) 

02-27-2009 


DATE (mm-M-yyyy) b6 Per 
b7C DOS 

02-27-2009 


NAME AND ADDRESS (Type orpi.VJ 


NAME AND ADDRE55 (Type orpnm) 


SA-20, 13th fl. DS/ISiAPD 
1801 North Lynn Street, 
Arlington, Virginia 22209 
571-345-3066 


SA-20,13th fl. D§/is/apd 

1801 North Lynn Street, 
Arlington, Virginia 22209 
571-345-3066 


SFCURITY DEBRIEFING ACKNOWLEDGMENT 


1 reaffirm that the provisions of the esDfefe'-ieTaws 
information have bed 
classified infotwifonl 
unauthorized 

other federal criminal laws and executive orders applicable to the safeguarding of classified 
have returned all classified information in my custody; that 1 will not communicate or transmit 
irgamzatiop; that 1 will promptly report to the Federal Bureau of Investigation any attempt by an 
idJbaHTfiave) (have not) (strike out inappropriate word or words) received a security debriefing. 

SIGNATURE 6 ?' 

NAME OF WITNESS ^1 



DATE (mm-dd-yyyy) 



SIGNATURE OF WITNESS 



b6 Per 
b7C DOS 


NOTICE: The Privacy Act. 5 U.S.C. 552a, requires that federal agencies inform individuals, at the time information is solicited from them, whether the 
disclosure is mandatory or voluntary, by what authority such information is solicited, and what uses will be made of the information. You are hereby 
advised that authority for soliciting your Social Security Number (SSN) is Executive Order 9397. Your SSN will be used to identify you precisely when it 
is necessary to 1) certify that you have access to the information indicated above or 2) determine that your access to the information indicated has 
terminated. Although disclosure of your SSN is not mandatory, your failure to do so may impede the processing of such certifications or determinations, 
or possibly result in the denial of your being granted access to classified information. 

*NOT APPLICABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT 
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CLASSIFIED INFORMATION NONDISCLOSURE AGREEMENT 


AN AGREEMENT BETWEEN 


AND THE UNITED STATES 


IIIJIl.tr.5.TT^HU.UUI P IIMIUU Ull 

typed) 


1. Intending to be legally bound, I hereby acceptthepbygafions contained in this Agreement in consideration of my being granted 
access to classified information. As used in this Agreement, classified information is marked or unmarked classified information, 
including oral communications, that is classified under the standards of Executive Order 12958, or under any other Executive order or 
statute that prohibits the unauthorized disclosure of information in the interest of national security; and unclassified information that 
meets the standards for classification and is in the process of a classification determination as provided in Section 1.1, 1.2, 1.3 and 
1.4(e) of Executive Order 12958, or under any other Executive order or statute that requires protection for such information in the 
interest of national security. I understand and accept that by being granted access to classified information, special confidence and 
trust shall be placed in me by the United States Government. 

2. I hereby acknowledge that I have received a security indoctrination concerning the nature and protection of classified information, 
including the procedures to be followed in ascertaining whether other persons to whom I contemplate disclosing this information have 
been approved for access to it, and that I understand these procedures. 

3. I have been advised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified Sftfemiation by me 
could cause damage or irreparable injury to the United States or could be used to advantage by a foreign nation. (hereby agree that I 
will never divulge classified information to anyone unless: (a) I have officially verified that the recipient has been properly authorized by 
the United States Government to receive it; or (b) I have been given prior written notice of authorization from the United States 
Government Department or Agency (hereinafter Department or Agency) responsible for the classification of information or last granting 
me a security clearance that such disclosure is permitted. I understand that if I am uncertain about the classification status of 
information, I am required to confirm from an authorized official that the information is unclassified before I may disclose it, except to a 
person as provided in (a) or (b), above. I further understand that I am obligated ,tp comply with laws and regulations that prohibit the 
unauthorized disclosure of classified information. 

4. I have been advised that any breach of this Agreement may result in the termination of any security clearances I hold; removal from 
any position of special confidence and trust requiring such clearances; or termination of my employment or other relationships with the 
Departments or Agencies that granted my security clearance or clearances. In addition, I have been advised that any unauthorized 
disclosure of classified information by me may constitute a violation, or violations, of United States criminal laws, including the 
provisions of Sections 641, 793, 794, 798, *952 and 1924, Title 18. United States Code. *the provisions of Section 783(b), Title 50, 
United States code, and the provisions of the intelligence Identities Protection Act of 1982. I recognize that nothing in the Agreement 
constitutes a waiver by the United States of the right to prosecute me for any statutory violation. 

5. I hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result or may 
result from any disclosure, publication or revelation of classified information not consistent with the terms of this Agreement. 

6. I understand that the United States Government may seek any remedy available to it to enforce this Agreement including, but not 
limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. 

7. I understand that all classified information to which I have access or may obtain access by signing this Agreement is now and will 
remain the property of, or under the control of the United States Government unless and until otherwise determined by an authorized 
official or final ruling of a court of law. I agree that I shall return all classified materials which have, or may come into my possession or 
for which I am responsible because of such access: (a) upon demand by an authorized representative of the United States 
Government; (b) upon the conclusion of my employment or other relationship with the Department or Agency that last granted me a 
security clearance or that provided me access to classified information; or (c) upon the conclusion of my employment or other 
relationship that requires access to classified information. If I do not return such materials upon request. I understand that this may be 
a violation of Sections 793 and/or 1924, Title 18, United States Code, a United States criminal law. 

8. Unless and until I am released in writing by an authorized representative of the United States Government, I understand that all 
conditions and obligations imposed upon me by this Agreement apply during the time I am granted access to classified information, 
and at all times thereafter. 

Utl/H'/ • 

9. Each provision of this Agreement is severable. If a court should find any pfovision of this Agreement to be unenforceable, all other 

provisions of this Agreement shall remain in full force and effect, p ... 
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10. These restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights or 
liabilities created by Executive Order 12958, Section 7211 of Title 5, United States c®5e (governing disclosures to Congress); Section 
1034 of Title 10, United States code, as amended by the Military Whistleblower pjo&eSon Act (governing disclosure to Congress by 
members of the military); Section 2302(b) (8) of Title 5. United States Code, ss.s.’sended by the Whistleblower Protection Act 
(governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 
1982 (50 U.S.C. 421 et seq.) (governing disclosures that expose confidential Government agents), and the statutes which protect 
against disclosure that may compromise the national security, including Sections 641,793, 794, 798, 952 and 1924 of Title 18, United 
State Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. Section 783(b)). The definitions, requirements, 
obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement 
and are controlling. 


11.1 have read this Agreement carefully and my questions, if any, have been answered. I acknowledge that the briefing officer has 
made available to me the Executive Order and statutes referenced in this agreement and its implementing regulation (32 CFR Section 
2003.20) so that I may read them at this time, if I so choose. 


SIGNATURE 


I DATE (mm-ad-wwl 

InOV i 7 2008 


SOCIAL SECURITY NUMBER 

f Q °P jfcflea halnu .1 _ 


b6 Per DOS 


ORGANIZATION (IF CONTRACTOR, LICENSEE. GRANTEE OR AGENT, PROVIDE NAME. ADDRESS. AND IF APPLICABLE, FEDERAL SUPPLY CODE NUMBER) 
(Type or print) 


Circle one: GS FS PSC WAE Contractor Intern Other 

Bureau Assigned: Telephone: 


y 


WITNESS 


THE EXECUTION OF THIS AGREEMENT WAS WITNESSED 


RYTHF UNDFRSIGNFD. 


RFHAI F (TF THF UNITED 

1 STATES GOVERNMENT. b7C DOS 


1 




I DATE (mm-Oti-yyyy) 

N0Y 1 7 2008 

SIG 


DATE (mm-ad-yyyy) 

NOV 17 m 

NAME ANCnVUURtSSi (type or print) 


NAN 

It AND ADDRESS (type orpnnt) 


[ 


SA-20, 13th fl. DS/IS/APD 
1801 North Lynn Street, 
Arlington, Virginia 22209 
571-345-3066 


ACCEPTANCE 


THE UNDERSIGNED ACCEPTED THIS AGREEMENT ON 


b6 Per 




SA-20, 13th fl. DS/ls/APD 

1801 North Lynn Street, 
Arlington, Virginia 22209 
571-345-3066 


SECURITY DEBRIEFING ACKNOWLEDGMENT 


I reaffirm that the provisions of the espionage laws, other federal criminal laws and executive orders applicable to the safeguarding of classified 
information have been made available to me; that I have relumed all classified information in my custody; that I will not communicate or transmit 
classified information to any unauthorized person or organization; that I will promptly report to the Federal Bureau of Investigation any attempt by an 
unauthorized person to solicit classified information, and that I (have) (have not) (strike out inappropriate word or words) received a security debriefing 


Cl/1 Kl ATI IPF nc FAAPi nvpp 




NAME OF WITNESS (Type or print) 


SIGNATURE OF WITNESS 


DATE (mm-aO-yy/y) 


b6 

b7C 


NOTICE: The Privacy Act, 5 U.S.C. 552a. requires that federal agencies inisRi rficsviduals, a! the time information is solicited from them, whether the 
disclosure is mandatory or voluntary, by what authority such information is j>4S?i!*8,:and what uses will be made of the information You are hereby 
advised that authority for soliciting your Social Security Number (SSN) is Executive Order 9397. Your SSN will be used to identify ydu precisely when it 
is necessary to 1) certify that you have access to the information Indicated above or 2) determine that your access to the information indicated has 
terminated Although disclosure of your SSN is not mandatory, your failure to do so may impede the processing of such certifications or determinations, 
or possibly result in the denial of your being granted access to classified information. 

' "NOT APPLICABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT, 
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J 


rr.ASSTir nro INFORMATION NONDISCLOSURE AGREEMENT 


.AN agreement. BETWEEN 


AND THE UNITED STATES 

INTHTC jot uim Tru-ovr* - Tnrrrwror -iypx A )' • 

1 Intending to be legally bound. I hereby accept the obligations contained in this Agreement in. considerauon of .my being 
cmnted a«efs to classified information. As used in this Agreement, classified mformauon ,s marked or unmarked classified 
^formation, including oral communications, that is classified under .the standards of Execuuve Order 12356,- or under any. other 
Executive order or statute that prohibits the unauthorized disclosure of informauon m the interest of rational security; and 
unclassified information that meets the standards for classification and is in the process of a dassitoiian detemunauon as 
”Sd in Sections 1.1 and i.2(e) of Executive Order 12356. or under any other-Executive: order or;statute that requires 
protection for such informauon in the interest of national security. I understand and accept that byiieing granted access to 
classified information, special confidence and trust shall be placed in me by the United States Government. 

2 I hereby acknowledge that.I have received a security indoctrination concerning the nature and protecuon of classified 
information, including the procedures to be followed in ascertaining whether other persons to whom I contemplate disclosing this 
mformauon have been approved for access to it. and that I understand these procedures. 

3 I have been advised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified mformauon 
bv me could cause damage or irreparable injury to the United States or could be used to advantage by a foreign nation. I hereby 
agree that I will never divulge classified informauon to anyone unless: (a).I have,officially verified that the recipient has been 
oroDerly authorized by the United States Government to receive it; or (b) I have been given prior written nouce of authorization 
ftom the United States Government Department or Agency (hereinafter Department or Agency) responsible for the 
classification of the information or last granting me a security clearance that such disclosme is permitted. I understand Uiat if 
I am uncertain about the classification status of information. l am required to confirm from an.authorized offiaal that the 
information is unclassified before I may disclose it. except to a person as provided in (a) or (b), above. I further understand that 
I am obligated to comply with laws and regulations that prohibit the unauthorized disclosure of classified informauon. . 

4 I-have been advised that any breach of this Agreement may result in the termination of any security clearances I hold; 
removal from any position of special confidence and trust requiring such clearances; or the termination of my employment or 
other relationships with the Departments or Agencies that granted my security clearance or clearances. In addition. I havebeen 
advised that anytinauthorized-disclosure of classified information by me may consatute a viojauon. or^olauor^. of.Unued 
States criminal laws, including*the provisions of Sections 641, 793. 794, 798, and 952, Title 18, United States Code, 
•Ihe provisions of Section 783(b). Title 50, United States Code, and the provisions of the Intelligence Identities Protection Act 
of 1982. I recognize that nothing in this Agreement constitutes a waiver by the United States of the nght to prosecute me for any 
statutory violation. 

5 I hereby assign to the United States Government all royalties, remunerations, and emoluments that have remlted v^ re^u 
or may result from any disclosure, publication, or revelation of classified informauon not consistent with the terms of this 

Agreement. .... •'*’ . . • , . 

6. I understand that the United States Government may seek any remedy available to it to' enforce this Agreement including, 
but not limited to, application for a court order prohibiting disclosure of informauon m breach of this Agreement. 

7. I understand that all classified information to which I have access or may obtain access by si^g thb Agreement is now and 
will remain the property of. or under the control of the United States Government unless and-until otherwisedetermined by 
authorized official or fmal ruling of a court of law. I agree that I shall return aU ciassified znatennk ^cb.^ve^r_may come 

mv Dossession or for which I am responsible because of such access: (a) upon demand by an authorize^ representauve of the 
UnitedStates Government; (b) upon the conclusion'of my employment or-other rebuonship y 
that last granted me a security clearance or that provided me access to classified informauon, or (c) up<?p the coricjuaon y 
imniovment or other relationship that requires access to classified-information. If I do not return such>matcnals upon req est, 
±2iSfcSSSection 793. TO, 18. United Su.es Code, a United e^ndlaw. 


8. Unless and until I am released’in. writing by an authorized representative of the 

that all conditions and obligations imposed upon me by this Agreement apply during the time I am grafted access to 
information, and at all times thereafter. . 

9. Each provision of this Agreement is severable. If a court should find any provision of this Agreement to‘Be unenforceable, 

all other provisions of this Agreement shall remain in full force and effect. . . 

10. These restrictions are consistent with and do not supersede., conflict with or otherwise alter the cmployce obUgatio^. 

or liabilities created bv Execuuve Order 12356: Section 7211 of Title 5, United States Code (governing disclosures 5° ’ 

Section 1034 of TittelO. United States Code, as amended by the Military Whtolcblower Protecuon Act 
foCongress by members of the military); Section 2302(b)(8) of Title 5. United,Sut «^ 

Protection Act (governing disclosures of illegality, waste, fraud, abuse or public hea y confidential Government 

Identities Protection Act of 1982 (50 U.S.C. 421 et seq.) (governing disclpsures ^udSig Sections 641, 

agents); and the statutes .which protea against disclosure that may compromise f ,950 (50 U.S.C. 

793. 794, 798. and 952 of Title 18. United States Code. and.Section 4(b) of the Subve^vc 1 Act« nu^Aetot^O^v^ ^ 
Section 783(b)). The definitions, requirements, obligations, nghts, sanctions and.liabiliues created by said Ex 
listed, statutes are incorporated into this Agreement and are controlling. HRC-6378 
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112-102 



cut^^^c 


11. I have read this Agreement carefuBttki my questions, if any. have been answc JHkcknowlcdge that the briefing officer 
has made available to me the Execut^^^der and statutes referenced in this Ag^^^nt and its implementing regulation 
(32 CFR Section 2003.20) so that 1'may read them at this time, if I so choose. 




social SECtmrrr number 

(S« Notice below)_ 


b6 Per DOS 


r. PROVIDE: NAME. ADDRESS, AND. IF APPLICABLE. FESEBAL SUPPLY CODE NUMBER) 


WITNESS • 


THE EXECUTION OF THIS AGREEMENT WAS WITNESSED 
BY THE UNDERSIGNED. 


ACCEPTANCE . 


THE UNDERSIGNED ACCEPTED THIS AGREEMENT ON 
BEHALF OF THE UNITED STATES GOVERNMENT, b 



b6 Per] 
b7C DOS 


SEP I 7 1999 


DS/ISP/APB 
Department of State 
2201 C Street, N.W. 
Washington, D.C. 20520 


DS/ISP/APB 
Department of’ State 
2201. C Street, N.W. 
Washington, D.C. 20520 


• SECURITY DEBRIEFING ACKNOWLEDGEMENT ’ 


I reaffirm that the provisions of the espionage laws, other federal criminal, laws and executive orders applicable to the safeguarding of classified' 
Information have been made available to me; that I have returned all classified information in my custody; that I will not communicate or transmit 
classified Information to any unauthorised person or organization; that I will promptly report to the Federal Bureau of Investigation any attempt by an 
unauthorized person to solicit classified information, and that 1 (have) (have not) (strike out inappropriate word or words) received a security 
debriefing. 



NAME OF WITNESS cm* or pilot) 


NOTICE : The Privacy Act, S U.S.C JJ2a, require, that federal itcnclca Inform individual], at the time Inform.lion b aolicited from them, whether the dbclo.ure U mandatory 
or voluntary, by what authority inch Information b ihllcitcd, and what uaea will be made of the Information.' You arc hereby advbcd that authority (or aolleltla* your Social 
Security Account Number <SSN) b Executive Order »J»7. Your SSN will be tued to Identify you precbcly when It b neeeuary to 1) certify that you have aece.i to the 
Information Indicated above or 2) determine that your tcceaa to the Information Indicated haa terminated. Although dbcloaore of your SSN b not mandatory, your (allure to do 
to may Impede the proeeaalnt of aueh certification! or determination., or poaiibty reiult la the denial «( yoor belot {ranted acccaa to claaalflcd Information. 


- NOT APPLICABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT. __ 


STANDARD FORM 312 BACK (REV. 1-91) 
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1. Intending to be legally bound, I hereby accept the obligations contained in this Agreement in consideration of my being granted 
access to classified information. As used in this Agreement, classified information is marked or unmarked classified information, 
including oral communications, that is classified under the standards of Executive Order 12958, or under any other Executive order or 
statute that prohibits the unauthorized disclosure of information in the interest of national security; and unclassified information that 
meets the standards for classification and is in the process of a classification determination as provided in Section 1.1, 1.2, 1.3 and 
1.4(e) of Executive Order 12958, or under any other Executive order or statute that requires protection for such information in the 
interest of national security, I understand and accept that by being granted access to classified information, special confidence and 
trust shall be placed in me by the United States Government. 

2. I hereby acknowledge that I have received a security indoctrination concerning the nature and protection of classified information, 
including the procedures to be followed in ascertaining whether other persons to whom I contemplate disclosing this information have 
been approved for access to it, and that I understand these procedures. 

3. I have been advised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified information by me 
could cause damage or irreparable injury to the United States or could be used to advantage by a foreign nation. I hereby agree that I 
will never divulge classified information to anyone unless: (a) I have officially verified that the recipient has been properly authorized by 
the United States Government to receive it; or (b) I have been given prior written notice of authorization from the United States 
Government Department or Agency (hereinafter Department or Agency) responsible for the classification of information or last granting 
me a security clearance that such disclosure is permitted. I understand that if I am uncertain about the classification status of 
information, I am required to confirm from an authorized official that the information is unclassified before I may disclose it, except to a 
person as provided in (a) or (b), above. I further understand that I am obligated to comply with laws and regulations that prohibit the 
unauthorized disclosure of classified information. 


4. I have been advised that any breach of this Agreement may result in the termination of any security clearances I hold; removal from 
any position of special confidence and trust requiring s&i» i^earances; or termination of my employment or other relationships with the 
Departments or Agencies that granted my security or clearances. In addition, I have been advised that any unauthorized 

disclosure of classified information by me may violation, or violations, of United States criminal laws, including the 

provisions of Sections 641, 793, 794, 798, *952 and 1924, Title 18, United States Code, ‘the provisions of Section 783(b), Title 50, 
United States code, and the provisions of the intelligence Identities Protection Act of 1982. I recognize that nothing in the Agreement 


constitutes a waiver by the United States of the right to prosecute me for any statutory violation. 

5. I hereby assign to the United States Government all royalties, remunerations, and emoluments that have re: 
result from any disclosure, publication or revelation of classified information not consistent with the terms of this 






6. I understand that the United States Government may seek any remedy available to it to enforce this Agreemenf;fc#^Sk^^ 
limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. 




7. I understand that all classified information to which I have access or may obtain access by signing this Agreement is now and will 
remain the property of, or under the control of the United States Government unless and until otherwise determined by an authorized 
official or final ruling of a court of law. I agree that I shall return all classified materials which have, or may come into my possession or 
for which I am responsible because of such access: (a) upon demand by an authorized representative of the United States 
Government; (b) upon the conclusion of my employment or other relationship with the Department or Agency that last granted me a 
security clearance or that provided me access to classified information; or (c) upon the conclusion of my employment or other 
relationship that requires access to classified information. If I do not return such materials upon request, I understand that this may be 
a violation of Sections 793 and/or 1924, Title 18, United States Code, a United States criminal law. 

8. Unless and until I am released in writing by an authorized representative of the United States Government. I understand that all 

conditions and obligations imposed upon me by this Agreement apply during the time fain granted'adflesSiy'classified information, 
and at all times thereafter. .... 

9. Each provision of this Agreement is severable. If a court should find dny provision. ^8^ AgBeS&rarfrtQ^uftkqfbrceable, all other 

provisions of this Agreement shall remain in full force and effect, - ,; *'* • — 

“'• u 0 1 : J 1 s 


NSN 7540-01-280-549S 
Previous edilion not usable 


ijtii 

(Continue on reverse.) 


• 
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10. These restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights or 
liabilities created by Executes G *S3r 12958, Section 7211 of Title 5. United States code (governing disclosures to Congress); Section 
1034 of Title 10, United StsSes jorie, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by 
members of the military); iSIfer 2302(b) {6; of Title 5, United States Code, as amended by the Whistleblower Protection Act 
(governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 
1982 (50 U.S.C. 421 et seq.) (governing disclosures that expose confidential Government agents), and the statutes which protect 
against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, 952 and 1924 of Title 18, United 
State Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. Section 783(b)). The definitions, requirements, 
obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement 
and are controlling. 


11.1 have read this Agreement car^f.^hd'my questions, if any, have been answered. I acknowledge that the briefing officer has 
made available to me the Executive sSSefcihd statutes referenced in this agreement and its implementing regulation (32 CFR Section 
2003.20) so that I may read them at this time, if I so choose. 




DATE (mm-dd-yyyy) 

01-26-2009 

sc 

(S 

JCIAL SECURITY NUMBER 
ee Notice below) 

b6 Per DOS 


ENSEE, GRANTEE OR AGENT. PROVIDE: NAME. ADDRESS, AND IF A 

PPUCABLE, FEDERAL SUPPLY CODE 

NUMBER) 


(Type or print) 


Circle one: GS FS PSC WAE Contractor Intern Other 


Telephone: ( ) 


WITNESS 


Tp'EXmfnQN OF THIS AGREEMENT WAS WITNESSED 

'm: the undersigned. 


name anu auukess | type vi prim) 


DATE (mm-dd-yyyy) 


01-26-2009 


SA-2U, 13th H. US.TS/APD 
1801 North Lynn Street, 
Arlington, Virginia 22209 
571 ^^— 


ACCEPTANCE 


THE UNDERSIGNED ACCEPTED THIS AGREEMENT ON 
BEHALF OF THE UNITED STATES GOVERNMENT. 


NAMt ANU AUuKfcSS (type orpnnl} 


DATE (mm-dd-yyyy) b6 Per 
b7C DOS 

01-26-2009 


SA-20, 13th fl. DS/IS/APD 
1801 North Lynn StTeet, 
Arlington, Virginia 22209 
571-345-3066 


SECURITY DEBRIEFI 

1 _ 

ING ACKNOWLEDGMENT 

1 reaffirm that the provisions of the espionage laws, other federal criminal laws and executive orders applicable to the safeguarding of classified 
information have been made available to me; that 1 have r«urmd all classified information in my custody; that I will not communicate or transmit 
classified information to any unauthorized person or organization; that I will promptly report to the Federal Bureau of Investigation any attempt by an 
unauthorized person to solicit classified information, and that I (have) (have not) (strike out inappropriate word or words) received a security debriefing. 

SIGNATURE OF EMPLOYEE 

DATE (mm-dd-yyyy) 

NAME OF WITNESS (Type or print) 

SIGNATURE OF WITNESS 


NOTICE: The Privacy Act, 5 U.S.C. 552a, requires that federal agencies inform individuals, at the time information is solicited from them, whether the 
disclosure is mandatory or voluntary, by what authority such information is solicited, and what uses will be made of the information. You are hereby 
advised that authority for soliciting your Social Security Number (SSN) is Executive Order 9397. Your SSN will be used to identify you precisely when it 
is necessary to 1) certify that you have access to the information indicated above or 2) determine that your access to the information indicated has 
terminated. Although disclosure of your SSN is not mandatory, your failure to do so may impede the processing of such certifications or determinations, 
or possibly result in the denial of your being granted access to classified information. 

'NOT APPLICABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT. 


STANDARD FORM 312 BACK (Rev. 1-00) 
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